{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The abuse of signed administrative software like MSP360 bypasses traditional reputation-based security controls. A negative result provides assurance that masqueraded installers have not established persistence via service-based footholds." }, "name": "Masqueraded MSP360 RMM Installer and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1059.001", "attack.t1543.003", "attack.t1547.001", "attack.t1106", "attack.t1190", "collection", "command and control", "execution", "initial access", "persistence" ], "series": { "slug": "phishing-abuses-rmm-tools-for-persistent-access", "index": 1, "title": "Phishing Abuses RMM Tools for Persistent Access", "total": 2 }, "related": [ { "hunt": "redundant-rmm-screenconnect-deployment", "reason": "This hunt focuses on the initial MSP360 foothold; the follow-on ScreenConnect deployment and post-compromise tooling are covered in a separate hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might alert on any MSP360 installation. This hunt uses a gated flow to evaluate phishing-specific filenames and paths, corroborates them with persistent service creation, and uses stack-counting to differentiate a targeted attack from legitimate IT updates.", "coverage": [ { "stage": "initial-access-phishing-lures", "steps": [ "masqueraded-installer-lead" ], "status": "covered" }, { "stage": "execution-installer-elevation", "steps": [ "masqueraded-installer-lead", "service-persistence" ], "status": "covered" }, { "stage": "persistence-rmm-foothold", "steps": [ "service-persistence" ], "status": "covered" }, { "stage": "c2-redundant-rmm-deployment", "reason": "Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series.", "status": "out_of_scope" }, { "stage": "post-compromise-tooling", "reason": "Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Phishing via Masqueraded RMM Installer", "slug": "initial-access-phishing-lures", "tactic": "initial-access", "techniques": [ "T1566", "T1190" ], "observables": [ "VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid.exe", "ZoomSetup_Installation_v2.5.0.67_oid.exe", "PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid.exe", "RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_oid.exe", "SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid.exe", "108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc", "f34330d4c6e0aa978dc3af40360c14b31ad51127", "gitlab.com", "dropbox.com" ] }, { "name": "Installer Execution and UAC Elevation", "slug": "execution-installer-elevation", "tactic": "execution", "techniques": [ "T1059.001", "T1106" ], "observables": [ "System.dll", "nsExec.dll", "UAC.dll", "eventcreate.exe", "dotnet --list-runtimes", "MSP360 RMM Agent installer", "Begin installation", "End installation. MSP360 de Success." ] }, { "name": "RMM Agent Persistence and Configuration", "slug": "persistence-rmm-foothold", "tactic": "persistence", "techniques": [ "T1543.003", "T1547.001" ], "observables": [ "RMM.Agent.exe", "RMM.Agent.Launcher.exe", "C:\\Program Files\\RMM Agent\\", "UDP port 48678" ] }, { "name": "PowerShell Deployment of Secondary RMM", "slug": "c2-redundant-rmm-deployment", "tactic": "command-and-control", "techniques": [ "T1059.001", "T1105" ], "observables": [ "Invoke-WebRequest", "ClientSetup.msi", "msiexec.exe /qn", "ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe" ] }, { "name": "Deployment of Information Collection Tools", "slug": "post-compromise-tooling", "tactic": "collection", "techniques": [ "T1555", "T1005" ], "observables": [ "C:\\Users\\%user%\\Documents\\ScreenConnect\\Temp\\", "WebBrowserPassView.exe", "WindowsSecurity_PIN.exe", "DefenderControl.exe", "WebBrowserBookmarksView.exe", "WindVerify.exe", "Passwords.EXE" ] } ], "summary": "Threat actors use phishing lures themed as meeting invites and software updates to deliver masqueraded MSP360 RMM installers. Once established, the RMM agent executes PowerShell to deploy a redundant ScreenConnect client, which serves as a platform for transferring and executing various credential theft and information collection utilities." }, "severity": "high", "rationale": "Focus on endpoints where users are likely to encounter phishing lures. Legitimate IT deployments of MSP360 usually occur on servers; a user-profile execution on a workstation is a high-fidelity trigger for this campaign.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker is distributing a legitimate but masqueraded MSP360 RMM installer via phishing lures to establish persistent, service-based administrative access on endpoints.", "parameters": { "rmm_hashes": { "from": { "ref": "msrc-blog-2026-09-29", "kind": "article", "observed": "2026-09-29" }, "type": "list[hash]", "default": [ "108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc", "f34330d4c6e0aa978dc3af40360c14b31ad51127" ], "description": "Known hashes for the MSP360 RMM installer version 2.5.0.67." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional host list to narrow the hunt; leave empty to scan the full estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "rare_threshold": { "type": "number", "default": "5", "description": "Maximum number of hosts a binary can appear on to be considered rare." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/", "name": "Microsoft Security Blog \u2014 Phishing Abuses RMM Tools for Persistent Access" } ], "blind_spots": [ { "id": "no-process-events", "risk": "A host without endpoint telemetry contributes no process rows, allowing execution from a user profile to go unobserved.", "owner": "Endpoint Security", "stage": "initial-access-phishing-lures", "question": "Which masqueraded binaries were executed by the user?", "requires": "hb_process_activity with process command line", "remediation": "Deploy endpoint sensors to all workstations and ensure process creation auditing is enabled." }, { "id": "no-service-telemetry", "risk": "The hunt cannot confirm a successful foothold without service installation logs, leading to missed compromises.", "owner": "Infrastructure Ops", "stage": "persistence-rmm-foothold", "question": "Was the persistence service successfully installed on the host?", "requires": "hb_service_activity with service installation events", "remediation": "Enable and centralize Security log collection for service installation events (Event ID 4697/7045)." } ] }, "name": "Masqueraded MSP360 RMM Installer and Persistence", "description": "This hunt identifies the abuse of legitimate Remote Monitoring and Management (RMM) software, specifically MSP360 (v2.5.0.67), used to establish an initial foothold. The adversary distributes the signed installer through social-engineering lures themed around Zoom, PDF updates, or meeting invitations. Once executed from a user profile, the installer elevates and installs persistent Windows services. We open by scoping existing RMM footprints, then use a gated lead query to identify suspicious execution patterns. If the lead is judged suspicious, the hunt fanned out to investigate service persistence and the rarity of the installer across the estate to distinguish a targeted attack from legitimate IT activity." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "phishing-abuses-rmm-tools-for-persistent-access", "index": 1, "title": "Phishing Abuses RMM Tools for Persistent Access", "total": 2 }, "coverage": [ { "stage": "initial-access-phishing-lures", "steps": [ "masqueraded-installer-lead" ], "status": "covered" }, { "stage": "execution-installer-elevation", "steps": [ "masqueraded-installer-lead", "service-persistence" ], "status": "covered" }, { "stage": "persistence-rmm-foothold", "steps": [ "service-persistence" ], "status": "covered" }, { "stage": "c2-redundant-rmm-deployment", "reason": "Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series.", "status": "out_of_scope" }, { "stage": "post-compromise-tooling", "reason": "Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series.", "status": "out_of_scope" } ], "rationale": "An attacker is distributing a legitimate but masqueraded MSP360 RMM installer via phishing lures to establish persistent, service-based administrative access on endpoints.", "blind_spots": [ { "id": "no-process-events", "risk": "A host without endpoint telemetry contributes no process rows, allowing execution from a user profile to go unobserved.", "owner": "Endpoint Security", "stage": "initial-access-phishing-lures", "question": "Which masqueraded binaries were executed by the user?", "requires": "hb_process_activity with process command line", "remediation": "Deploy endpoint sensors to all workstations and ensure process creation auditing is enabled." }, { "id": "no-service-telemetry", "risk": "The hunt cannot confirm a successful foothold without service installation logs, leading to missed compromises.", "owner": "Infrastructure Ops", "stage": "persistence-rmm-foothold", "question": "Was the persistence service successfully installed on the host?", "requires": "hb_service_activity with service installation events", "remediation": "Enable and centralize Security log collection for service installation events (Event ID 4697/7045)." } ], "scoping_notes": "Focus on endpoints where users are likely to encounter phishing lures. Legitimate IT deployments of MSP360 usually occur on servers; a user-profile execution on a workstation is a high-fidelity trigger for this campaign.", "beyond_detection": "A single rule might alert on any MSP360 installation. This hunt uses a gated flow to evaluate phishing-specific filenames and paths, corroborates them with persistent service creation, and uses stack-counting to differentiate a targeted attack from legitimate IT updates." } }, { "id": "identify-rmm-scope", "type": "query", "label": "Identify RMM software footprint", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%msp360%' OR LOWER(package_name) LIKE '%rmm agent%' OR LOWER(vendor_name) LIKE '%msp360%'", "surface": "hb_software_inventory", "description": "Find hosts where MSP360 or RMM agent software is already installed to focus the investigation.", "expected_signal": "A list of hosts currently running or with MSP360 installed. This provides context for where legitimate RMM activity is expected." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify RMM software footprint", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%msp360%' OR LOWER(package_name) LIKE '%rmm agent%' OR LOWER(vendor_name) LIKE '%msp360%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts currently running or with MSP360 installed. This provides context for where legitimate RMM activity is expected.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "masqueraded-installer-lead", "type": "query", "label": "Masqueraded RMM installer execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, process_hash_sha256, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND (LOWER(process_path) LIKE '%\\users\\%' OR LOWER(process_path) LIKE '%\\downloads\\%' OR LOWER(process_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find RMM installer execution from user-writable paths using filenames designed to masquerade as common software or documents.", "expected_signal": "A process launch matching the RMM version or hash from a user directory. Silence suggests no such masqueraded installers were executed in the window." }, "parents": [ { "id": "identify-rmm-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Masqueraded RMM installer execution", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "process_hash_sha256", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, process_hash_sha256, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND (LOWER(process_path) LIKE '%\\users\\%' OR LOWER(process_path) LIKE '%\\downloads\\%' OR LOWER(process_path) LIKE '%\\temp\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A process launch matching the RMM version or hash from a user directory. Silence suggests no such masqueraded installers were executed in the window.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "gate-read", "type": "analytic", "label": "Evaluate lead suspicion", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "masqueraded-installer-lead" ], "objective": "Review the process executions in masqueraded-installer-lead. Determine if the filenames (e.g. including 'Zoom', 'PDF', 'ECARD', 'INVITATION') combined with the RMM version string 'v2.5.0.67' indicate a social-engineering lure.", "description": "The agent reviews the lead query results to determine if the process filenames and paths suggest a phishing lure versus a legitimate admin action.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the execution is suspicious for a masqueraded lure.", "success_criteria": "A verdict of suspicious for any host showing masqueraded RMM execution from a user profile." }, "parents": [ { "id": "masqueraded-installer-lead" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate on suspicion", "config": { "fuzzy": true, "judge": "hunter", "question": "the gate-read verdict is suspicious for at least one host", "condition": "the gate-read verdict is suspicious for at least one host", "blind_spot": "no-process-events", "confidence": "high", "description": "Route to expensive corroboration queries only if the initial lead is judged suspicious.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gate-read" } ] }, { "id": "service-persistence", "type": "query", "label": "RMM service persistence", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, service_name, service_cmd_line, actor_user_name, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE 'rmm.agent%' OR LOWER(service_cmd_line) LIKE '%rmm agent%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_service_activity", "description": "Find evidence of successful RMM service installation following the lead execution.", "expected_signal": "Creation of RMM.Agent or RMM.Agent.Launcher services. Silence suggests elevation or installation failed." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "RMM service persistence", "reads": [ "device_hostname", "service_name", "service_cmd_line", "actor_user_name", "time" ], "source": "hb_service_activity", "target": "endpoint", "content": "SELECT device_hostname, service_name, service_cmd_line, actor_user_name, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE 'rmm.agent%' OR LOWER(service_cmd_line) LIKE '%rmm agent%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of RMM.Agent or RMM.Agent.Launcher services. Silence suggests elevation or installation failed.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "installer-rarity", "type": "query", "label": "Installer rarity stack-count", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= {{rare_threshold}}", "surface": "hb_process_activity", "description": "Determine if the suspicious binary name or hash is rare across the fleet, which distinguishes targeted lures from wide software updates.", "expected_signal": "A stack-count showing the binary is unique or extremely rare. Silence on rarity suggests a broader, potentially legitimate deployment." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Installer rarity stack-count", "reads": [ "process_name", "device_hostname", "process_hash_sha256", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= {{rare_threshold}}", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A stack-count showing the binary is unique or extremely rare. Silence on rarity suggests a broader, potentially legitimate deployment.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "name" ], "rare_below": 5 }, "verified_at": "2026-10-15" } }, { "id": "final-triage", "type": "analytic", "label": "Triage foothold and rarity", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "gate-read", "service-persistence", "installer-rarity" ], "objective": "Determine if any host has been successfully compromised via a masqueraded MSP360 installer. Correlate the suspicious execution identified in gate-read with the service creation and installer rarity.", "description": "A second agent weights the lead lure, the resulting service persistence, and the rarity of the event to reach a final verdict.", "max_iterations": 5, "expected_signal": "A per-host verdict of malicious for confirmed masqueraded installations.", "success_criteria": "A verdict of malicious for hosts showing the phishing lure followed by service persistence and binary rarity." }, "parents": [ { "id": "service-persistence", "kind": "merge" }, { "id": "installer-rarity", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on final verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "no-service-telemetry", "confidence": "high", "description": "Determine whether to contain the host or finalize the hunt.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate endpoint", "config": { "target": "endpoint", "description": "Contain the threat before follow-on payloads like ScreenConnect are deployed.", "instructions": "Isolate the endpoint. Stop and delete the RMM.Agent and RMM.Agent.Launcher services. Collect the installer binary from the user's profile for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Forensic review", "config": { "assignee": "analyst", "description": "Verify findings and check for redundant ScreenConnect deployment.", "instructions": "Review the lead and service rows. Specifically check if RMM.Agent.exe spawned PowerShell to download ClientSetup.msi, which indicates the second remote access channel has been deployed." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Finalize documentation and log findings.", "instructions": "Record the examined hosts and findings. Document any legitimate MSP360 use cases to update the excluded scope for future periodic runs." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }