Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-RMM-UnauthorizedToolDeployment.
Upgrade to ProDetect Ransomware Affiliates Weaponizing Legitimate RMM Software (ScreenConnect, AnyDesk, Atera) as Post-Compromise Access Tooling in Elastic Security
Rather than developing custom malware, ransomware affiliates and initial access brokers increasingly obtain commercially available, code-signed Remote Monitoring and Management (RMM) software — ScreenConnect, AnyDesk, Atera, Splashtop, NetSupport Manager — for use as post-compromise remote-access tooling. Because these tools are legitimate, digitally signed, and widely deployed by managed service providers, they are frequently absent from allowlists built around known-malicious binaries (Mimikatz, Cobalt Strike, PsExec) and evade signature-based AV/EDR detection entirely. The documented Storm-1811/Black Basta chain (CISA AA23-325A) begins with email-bombing a victim with spam, then a threat actor impersonating IT/helpdesk staff calls the victim and talks them into opening Microsoft Quick Assist (quickassist.exe) or Windows Remote Assistance (msra.exe) to grant screen control; the actor then installs ScreenConnect or AnyDesk through that session to establish durable, unauthorized remote access before deploying ransomware. Detection therefore pivots from the acquisition itself (which occurs outside the victim environment via a legitimate vendor download/trial signup) to observing the installation and execution of RMM binaries that are not present on the organization's sanctioned-tooling allowlist, with highest confidence when that installation is directly preceded by a Quick Assist or Remote Assistance session on the same endpoint.
MITRE ATT&CK
- Tactic
- Resource Development
Elastic Detection Query
sequence by host.name with maxspan=4h
[process where event.type == "start" and
process.name : ("quickassist.exe", "msra.exe")]
[process where event.type == "start" and
process.name : ("screenconnect.clientservice.exe", "screenconnect.windowsclient.exe",
"anydesk.exe", "ateraagent.exe", "srservice.exe", "client32.exe",
"teamviewer.exe", "lmiguardiansvc.exe", "rustdesk.exe", "gotoresolve.exe")]EQL sequence reconstructing the highest-confidence variant of this scenario: a Quick Assist or Windows Remote Assistance session followed, on the same host within 4 hours, by the launch of any RMM client binary. This captures the documented Storm-1811/Black Basta chain directly; pair with a standalone Elastic rule alerting on any of the listed RMM binaries absent from an EDR exception/allowlist for the broader, lower-confidence unsanctioned-tool signal that this sequence cannot express alone.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT help desk workflows that use Quick Assist and then hand off to a sanctioned RMM tool for follow-on support
- Coincidental, unrelated RMM installation shortly after a genuine Quick Assist troubleshooting session
Other platforms for THREAT-RMM-UnauthorizedToolDeployment
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Quick Assist Followed by Unsanctioned RMM Binary Launch
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for quickassist.exe (renamed notepad.exe copy) followed approximately 5 seconds later by process creation for anydesk.exe (renamed notepad.exe copy), both under the test account on the same host.
- Test 2Unsanctioned RMM Binary Execution Without Prior Remote-Assist Session
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for ateraagent.exe (renamed notepad.exe copy), with no preceding quickassist.exe or msra.exe event on the same host.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-RMM-UnauthorizedToolDeployment — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month