Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-RMM-UnauthorizedToolDeployment.
Upgrade to ProDetect Ransomware Affiliates Weaponizing Legitimate RMM Software (ScreenConnect, AnyDesk, Atera) as Post-Compromise Access Tooling in Sumo Logic CSE
Rather than developing custom malware, ransomware affiliates and initial access brokers increasingly obtain commercially available, code-signed Remote Monitoring and Management (RMM) software — ScreenConnect, AnyDesk, Atera, Splashtop, NetSupport Manager — for use as post-compromise remote-access tooling. Because these tools are legitimate, digitally signed, and widely deployed by managed service providers, they are frequently absent from allowlists built around known-malicious binaries (Mimikatz, Cobalt Strike, PsExec) and evade signature-based AV/EDR detection entirely. The documented Storm-1811/Black Basta chain (CISA AA23-325A) begins with email-bombing a victim with spam, then a threat actor impersonating IT/helpdesk staff calls the victim and talks them into opening Microsoft Quick Assist (quickassist.exe) or Windows Remote Assistance (msra.exe) to grant screen control; the actor then installs ScreenConnect or AnyDesk through that session to establish durable, unauthorized remote access before deploying ransomware. Detection therefore pivots from the acquisition itself (which occurs outside the victim environment via a legitimate vendor download/trial signup) to observing the installation and execution of RMM binaries that are not present on the organization's sanctioned-tooling allowlist, with highest confidence when that installation is directly preceded by a Quick Assist or Remote Assistance session on the same endpoint.
MITRE ATT&CK
- Tactic
- Resource Development
Sumo Detection Query
_sourceCategory="os/windows/sysmon"
| where EventID = "1"
| parse regex field=_raw "(?i)Image[=:]\s*(?:[^\"\s]*\\\\)?(?P<image>[^\\\"\s\r\n]+)" nodrop
| where image matches /(?i)(screenconnect\.clientservice|screenconnect\.windowsclient|anydesk|ateraagent|srservice|client32|teamviewer|lmiguardiansvc|rustdesk|gotoresolve)\.exe/
| lookup approved_rmm_tools on image=tool_name
| where isNull(is_sanctioned)
| fields _messageTime, _sourceHost, image
| sort by _messageTime descSumo Logic query flagging RMM client process launches (parsed from Sysmon Event ID 1 raw data) whose image name is not present in a maintained approved_rmm_tools lookup table. Correlate results against a companion search for quickassist.exe/msra.exe launches on the same _sourceHost within the preceding 4 hours to identify the highest-confidence help-desk vishing variant of this scenario.
Data Sources
Required Tables
False Positives & Tuning
- Lookup table staleness relative to the MSP's current sanctioned tool set
- Personal, non-support use of the listed remote-access clients
Other platforms for THREAT-RMM-UnauthorizedToolDeployment
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Quick Assist Followed by Unsanctioned RMM Binary Launch
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for quickassist.exe (renamed notepad.exe copy) followed approximately 5 seconds later by process creation for anydesk.exe (renamed notepad.exe copy), both under the test account on the same host.
- Test 2Unsanctioned RMM Binary Execution Without Prior Remote-Assist Session
Expected signal: Sysmon Event ID 1 / Security Event ID 4688: process creation for ateraagent.exe (renamed notepad.exe copy), with no preceding quickassist.exe or msra.exe event on the same host.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-RMM-UnauthorizedToolDeployment — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month