Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-RMM-UnauthorizedToolDeployment.
Upgrade to ProDetect Ransomware Affiliates Weaponizing Legitimate RMM Software (ScreenConnect, AnyDesk, Atera) as Post-Compromise Access Tooling in IBM QRadar
Rather than developing custom malware, ransomware affiliates and initial access brokers increasingly obtain commercially available, code-signed Remote Monitoring and Management (RMM) software — ScreenConnect, AnyDesk, Atera, Splashtop, NetSupport Manager — for use as post-compromise remote-access tooling. Because these tools are legitimate, digitally signed, and widely deployed by managed service providers, they are frequently absent from allowlists built around known-malicious binaries (Mimikatz, Cobalt Strike, PsExec) and evade signature-based AV/EDR detection entirely. The documented Storm-1811/Black Basta chain (CISA AA23-325A) begins with email-bombing a victim with spam, then a threat actor impersonating IT/helpdesk staff calls the victim and talks them into opening Microsoft Quick Assist (quickassist.exe) or Windows Remote Assistance (msra.exe) to grant screen control; the actor then installs ScreenConnect or AnyDesk through that session to establish durable, unauthorized remote access before deploying ransomware. Detection therefore pivots from the acquisition itself (which occurs outside the victim environment via a legitimate vendor download/trial signup) to observing the installation and execution of RMM binaries that are not present on the organization's sanctioned-tooling allowlist, with highest confidence when that installation is directly preceded by a Quick Assist or Remote Assistance session on the same endpoint.
MITRE ATT&CK
- Tactic
- Resource Development
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
"Computer Name" AS host,
username,
"Process Name" AS process_name,
"Command" AS command_line
FROM events
WHERE
("Event ID" = '1')
AND (
LOWER("Process Name") ILIKE '%screenconnect.clientservice.exe' OR
LOWER("Process Name") ILIKE '%screenconnect.windowsclient.exe' OR
LOWER("Process Name") ILIKE '%anydesk.exe' OR
LOWER("Process Name") ILIKE '%ateraagent.exe' OR
LOWER("Process Name") ILIKE '%srservice.exe' OR
LOWER("Process Name") ILIKE '%client32.exe' OR
LOWER("Process Name") ILIKE '%teamviewer.exe' OR
LOWER("Process Name") ILIKE '%lmiguardiansvc.exe' OR
LOWER("Process Name") ILIKE '%rustdesk.exe' OR
LOWER("Process Name") ILIKE '%gotoresolve.exe'
)
AND NOT REFERENCESET("Process Name", 'Approved_RMM_Tools')
AND LAST(devicetime) > NOW() - 86400000
ORDER BY devicetime DESCAQL query for IBM QRadar identifying execution of RMM client binaries that do not match a maintained reference set of approved RMM tooling ('Approved_RMM_Tools'). Pair with a QRadar custom rule that fires an additional Critical-severity offense when the same asset generated a Quick Assist (quickassist.exe) or Remote Assistance (msra.exe) event within the preceding 4 hours, reconstructing the Storm-1811/Black Basta help-desk vishing chain.
Data Sources
Required Tables
False Positives & Tuning
- Stale reference set data relative to the MSP's actual current RMM tool mix
- Legitimate personal or IT-sanctioned use of the listed remote-access clients not yet added to the reference set
Other platforms for THREAT-RMM-UnauthorizedToolDeployment
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Quick Assist Followed by Unsanctioned RMM Binary Launch
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for quickassist.exe (renamed notepad.exe copy) followed approximately 5 seconds later by process creation for anydesk.exe (renamed notepad.exe copy), both under the test account on the same host.
- Test 2Unsanctioned RMM Binary Execution Without Prior Remote-Assist Session
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for ateraagent.exe (renamed notepad.exe copy), with no preceding quickassist.exe or msra.exe event on the same host.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-RMM-UnauthorizedToolDeployment — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month