--- analysis: A simple detection rule on RMM domains fires on legitimate IT activity. This hunt uses a prevalence model to identify rare RMM usage and corroborates it with User-Agent metadata, requiring an analyst and agent to weigh the context of the host's role. blind_spots: - id: doh-blind-spot question: whether the RMM tool is using DNS-over-HTTPS (DoH) to bypass network-level DNS logging requires: cleartext DNS logging or endpoint-based DNS visibility risk: Malicious RMM clients using DoH will not appear in hb_dns_activity. stage: rmm-network-c2 - id: no-http-telemetry question: whether the RMM tool is presenting a recognizable User-Agent requires: hb_http_activity from a proxy or endpoint agent risk: Without HTTP metadata, the hunt relies entirely on DNS prevalence, which may increase false positives. stage: rmm-network-c2 coverage: - stage: rmm-network-c2 status: covered steps: - rmm-dns-leads - rmm-dns-prevalence - rmm-http-user-agents - reason: Belongs to the first hunt in this series (Abused RMM Staging and Lures). stage: initial-access-rmm-lures status: out_of_scope - reason: Belongs to the first hunt in this series. stage: loader-execution-and-staging status: out_of_scope - reason: Belongs to the first hunt in this series. stage: rmm-persistence-and-installation status: out_of_scope - reason: Handled by identity-focused hunts targeting credential theft. stage: credential-access-and-follow-on status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: RMM abuse is a common precursor to ransomware. Identifying these tools via network patterns provides a platform-agnostic detection method that works even when adversaries use signed, legitimate binaries to bypass endpoint security. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using unauthorized remote monitoring and management (RMM) tools for command and control, detectable via rare DNS lookups to RMM domains and specific User-Agent strings. labels: - hunt - attack.t1071.001 - attack.t1071.004 - attack.t1105 name: Abused RMM Infrastructure and Network Patterns parameters: lookback_days: default: '14' description: Days of historical telemetry to examine. type: number rmm_domains: default: - remotepc.com - remotedesktop.com - syncromsp.com - syncroapi.com - kabutoservices.com - atera.com - cmdm.comodo.com - atera-agent-heartbeat.servicebus.windows.net description: Known RMM domains identified in recent abuse campaigns. from: kind: article observed: '2026-06-17' ref: red-canary-rmm-abuse type: list[domain] rmm_user_agents: default: - NetSupport Manager/1.3 - JWrapperDownloader - Servicing/1.0.29.18406 description: RMM-specific User-Agent strings identified in research. from: kind: article observed: '2026-06-17' ref: red-canary-rmm-abuse type: list[string] scope_hosts: default: [] description: Filter follow-on steps to these hosts; usually populated from the initial leads step. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://redcanary.com/blog/security-operations/rmm-detection/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on workstations and servers first. Servers typically have more static RMM usage patterns, making deviations stand out. The lead query acts as a gate; use its results to populate scope_hosts for follow-on steps. references: - name: 'The dual-use dilemma: Rethinking detection for remote access tool abuse' url: https://redcanary.com/blog/security-operations/rmm-detection/ related: - hunt: abused-rmm-persistence-and-installation reason: This hunt focuses on the network layer; binary-level persistence and service installation are handled in a separate hunt. relation: out-of-scope-alternative scenario: stages: - name: RMM Phishing Lures observables: - ssa.msi - Ecard9140.exe - party_invite.exe - Voicemailaudioext.exe - docmentfilecsm_jw98evavuqm5gb3.exe - IRS-Statement_Pr2ui4J9cfA6YEu.exe - invited.exe - MSTeam-installer.msi slug: initial-access-rmm-lures tactic: initial-access techniques: - T1566 - T1190 - name: RMM Loader Execution observables: - PowerShell downloading ZIP files - Batch files extracting ZIPs - SyncroLive.Agent.Runner.exe spawning msiexec.exe - client32.exe execution from C:\Users\Public\ slug: loader-execution-and-staging tactic: execution techniques: - T1059.001 - name: RMM Persistence and Installation observables: - client32.ini - HostService.exe - remotepcservice.exe - RMMService.exe - remotepchost1.exe - C:\ProgramData\PDQ\PDQConnectAgent\token - syncro.installer.exe slug: rmm-persistence-and-installation tactic: persistence techniques: - T1574.002 - name: RMM Network Communication observables: - remotepc.com - remotedesktop.com - syncromsp.com - syncroapi.com - kabutoservices.com - atera.com - cmdm.comodo.com - 'User-Agent: NetSupport Manager/1.3' - 'User-Agent: JWrapperDownloader' - 'User-Agent: Servicing/1.0.29.18406' - /access/JWrapper-Remote%20Access-version.txt slug: rmm-network-c2 tactic: command-and-control - name: Credential Access and Follow-on Payloads observables: - DICOMportable.zip - DicomPortable.exe - DeerStealer - HijackLoader - Sideloaded DLLs via ITarian slug: credential-access-and-follow-on tactic: credential-access techniques: - T1555 - T1486 summary: "Adversaries abuse legitimate, signed RMM tools like ScreenConnect, Syncro,\ \ and NetSupport by deploying them through phishing lures to establish stealthy\ \ persistence. These tools are often chained\u2014one RMM serving as a loader\ \ for others\u2014to facilitate follow-on malicious activity including credential\ \ theft and ransomware." series: index: 2 slug: the-dual-use-dilemma-rethinking-detection-for-remote-access-tool-abuse title: 'The dual-use dilemma: Rethinking detection for remote access tool abuse' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Abused RMM Infrastructure and Network Patterns Adversaries abuse legitimate RMM tools like Syncro, Atera, and NetSupport to maintain persistence and bypass binary-based detection. Because these tools are signed and trusted, their installation often goes unnoticed by signature-based tools. This hunt identifies unauthorized RMM usage by focusing on the network layer. It first scopes the environment for known RMM domains, then measures the fleet-wide prevalence of those domains to distinguish between sanctioned IT tools and malicious one-offs. It simultaneously inspects HTTP User-Agents for common RMM patterns on the suspicious hosts. An agent evaluates the combined evidence to determine if a host is compromised. ## rmm-dns-leads Identify any host in the estate making requests to known RMM infrastructure as a scoping lead. ```sqlite target=endpoint role=scoping params=(rmm_domains=rmm_domains, lookback_days=lookback_days) ~~~yaml expected: A list of hosts and the RMM domains they are resolving. This query acts as the gate for the hunt. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_dns_activity WHERE instr(',' || '{{rmm_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ``` ## rmm-corroboration parallel: - → rmm-dns-prevalence - → rmm-http-user-agents join: → triage-rmm-network ## rmm-dns-prevalence Stack-count the domains seen on lead hosts to find rare instances that indicate unauthorized RMM usage. ```sqlite target=endpoint role=baseline params=(rmm_domains=rmm_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: RMM domains resolving on very few hosts. Fleet-wide IT tools will have high host counts and can be filtered. prevalence: by: device_hostname key: - query_hostname rare_below: 4 reads: - query_hostname - device_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT LOWER(query_hostname) as rmm_domain, COUNT(DISTINCT device_hostname) as host_count, COUNT(*) as total_lookups FROM hb_dns_activity WHERE instr(',' || '{{rmm_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC ``` ## rmm-http-user-agents Identify specific RMM clients by their unique HTTP User-Agent strings on the suspect hosts. ```sqlite target=web role=enrichment params=(lookback_days=lookback_days, rmm_user_agents=rmm_user_agents, scope_hosts=scope_hosts) ~~~yaml expected: Hits on these User-Agent strings strongly suggest the presence of unauthorized NetSupport or Syncro agents. reads: - device_hostname - url_hostname - user_agent - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_hostname, user_agent, time FROM hb_http_activity WHERE instr(',' || '{{rmm_user_agents}}' || ',', ',' || user_agent || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-rmm-network ```agent target=hunter cite: required context: - rmm-dns-leads - rmm-dns-prevalence - rmm-http-user-agents max_iterations: 4 objective: Determine if any host is running an unauthorized RMM tool based on the rarity of the C2 domain and the presence of identifying User-Agent strings. Differentiate between sanctioned IT tools and malicious deployments. success_criteria: A verdict for each host with supporting citations from the DNS and HTTP results. tools: - endpoint - web ``` ## rmm-decision if~: "the triage-rmm-network verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-http-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Collect the RMM configuration files (e.g. client32.ini or token files) before clearing the binary. ``` → analyst-review ## analyst-review ```manual target=analyst Examine the host for the RMM binary. Check its metadata and signature. Determine if it was installed by a legitimate IT process or dropped by a suspicious parent like PowerShell. ``` → close-out ## close-out ```manual target=analyst Record the sanctioned RMM tools identified. Update the organizational allowed software list and consider blocking unused RMM domains. ``` → end