--- analysis: A single rule might alert on any MSP360 installation. This hunt uses a gated flow to evaluate phishing-specific filenames and paths, corroborates them with persistent service creation, and uses stack-counting to differentiate a targeted attack from legitimate IT updates. blind_spots: - id: no-process-events owner: Endpoint Security question: Which masqueraded binaries were executed by the user? remediation: Deploy endpoint sensors to all workstations and ensure process creation auditing is enabled. requires: hb_process_activity with process command line risk: A host without endpoint telemetry contributes no process rows, allowing execution from a user profile to go unobserved. stage: initial-access-phishing-lures - id: no-service-telemetry owner: Infrastructure Ops question: Was the persistence service successfully installed on the host? remediation: Enable and centralize Security log collection for service installation events (Event ID 4697/7045). requires: hb_service_activity with service installation events risk: The hunt cannot confirm a successful foothold without service installation logs, leading to missed compromises. stage: persistence-rmm-foothold coverage: - stage: initial-access-phishing-lures status: covered steps: - masqueraded-installer-lead - stage: execution-installer-elevation status: covered steps: - masqueraded-installer-lead - service-persistence - stage: persistence-rmm-foothold status: covered steps: - service-persistence - reason: Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series. stage: c2-redundant-rmm-deployment status: out_of_scope - reason: Belongs to another part of the 'Phishing Abuses RMM Tools for Persistent Access' series. stage: post-compromise-tooling status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: The abuse of signed administrative software like MSP360 bypasses traditional reputation-based security controls. A negative result provides assurance that masqueraded installers have not established persistence via service-based footholds. methodology: model-assisted trigger: intel-report hypothesis: An attacker is distributing a legitimate but masqueraded MSP360 RMM installer via phishing lures to establish persistent, service-based administrative access on endpoints. labels: - hunt - attack.t1566 - attack.t1059.001 - attack.t1543.003 - attack.t1547.001 - attack.t1106 - attack.t1190 - collection - command and control - execution - initial access - persistence name: Masqueraded MSP360 RMM Installer and Persistence parameters: lookback_days: default: '14' description: Days of history to examine. type: number rare_threshold: default: '5' description: Maximum number of hosts a binary can appear on to be considered rare. type: number rmm_hashes: default: - 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc - f34330d4c6e0aa978dc3af40360c14b31ad51127 description: Known hashes for the MSP360 RMM installer version 2.5.0.67. from: kind: article observed: '2026-09-29' ref: msrc-blog-2026-09-29 type: list[hash] scope_hosts: default: [] description: Optional host list to narrow the hunt; leave empty to scan the full estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on endpoints where users are likely to encounter phishing lures. Legitimate IT deployments of MSP360 usually occur on servers; a user-profile execution on a workstation is a high-fidelity trigger for this campaign. references: - name: "Microsoft Security Blog \u2014 Phishing Abuses RMM Tools for Persistent Access" url: https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/ related: - hunt: redundant-rmm-screenconnect-deployment reason: This hunt focuses on the initial MSP360 foothold; the follow-on ScreenConnect deployment and post-compromise tooling are covered in a separate hunt. relation: out-of-scope-alternative scenario: stages: - name: Phishing via Masqueraded RMM Installer observables: - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid.exe - ZoomSetup_Installation_v2.5.0.67_oid.exe - PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid.exe - RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_oid.exe - SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid.exe - 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc - f34330d4c6e0aa978dc3af40360c14b31ad51127 - gitlab.com - dropbox.com slug: initial-access-phishing-lures tactic: initial-access techniques: - T1566 - T1190 - name: Installer Execution and UAC Elevation observables: - System.dll - nsExec.dll - UAC.dll - eventcreate.exe - dotnet --list-runtimes - MSP360 RMM Agent installer - Begin installation - End installation. MSP360 de Success. slug: execution-installer-elevation tactic: execution techniques: - T1059.001 - T1106 - name: RMM Agent Persistence and Configuration observables: - RMM.Agent.exe - RMM.Agent.Launcher.exe - C:\Program Files\RMM Agent\ - UDP port 48678 slug: persistence-rmm-foothold tactic: persistence techniques: - T1543.003 - T1547.001 - name: PowerShell Deployment of Secondary RMM observables: - Invoke-WebRequest - ClientSetup.msi - msiexec.exe /qn - ScreenConnect.ClientService.exe - ScreenConnect.WindowsClient.exe slug: c2-redundant-rmm-deployment tactic: command-and-control techniques: - T1059.001 - T1105 - name: Deployment of Information Collection Tools observables: - C:\Users\%user%\Documents\ScreenConnect\Temp\ - WebBrowserPassView.exe - WindowsSecurity_PIN.exe - DefenderControl.exe - WebBrowserBookmarksView.exe - WindVerify.exe - Passwords.EXE slug: post-compromise-tooling tactic: collection techniques: - T1555 - T1005 summary: Threat actors use phishing lures themed as meeting invites and software updates to deliver masqueraded MSP360 RMM installers. Once established, the RMM agent executes PowerShell to deploy a redundant ScreenConnect client, which serves as a platform for transferring and executing various credential theft and information collection utilities. series: index: 1 slug: phishing-abuses-rmm-tools-for-persistent-access title: Phishing Abuses RMM Tools for Persistent Access total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Masqueraded MSP360 RMM Installer and Persistence This hunt identifies the abuse of legitimate Remote Monitoring and Management (RMM) software, specifically MSP360 (v2.5.0.67), used to establish an initial foothold. The adversary distributes the signed installer through social-engineering lures themed around Zoom, PDF updates, or meeting invitations. Once executed from a user profile, the installer elevates and installs persistent Windows services. We open by scoping existing RMM footprints, then use a gated lead query to identify suspicious execution patterns. If the lead is judged suspicious, the hunt fanned out to investigate service persistence and the rarity of the installer across the estate to distinguish a targeted attack from legitimate IT activity. ## identify-rmm-scope Find hosts where MSP360 or RMM agent software is already installed to focus the investigation. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts currently running or with MSP360 installed. This provides context for where legitimate RMM activity is expected. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%msp360%' OR LOWER(package_name) LIKE '%rmm agent%' OR LOWER(vendor_name) LIKE '%msp360%' ``` ## masqueraded-installer-lead Find RMM installer execution from user-writable paths using filenames designed to masquerade as common software or documents. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, rmm_hashes=rmm_hashes, scope_hosts=scope_hosts) ~~~yaml expected: A process launch matching the RMM version or hash from a user directory. Silence suggests no such masqueraded installers were executed in the window. reads: - device_hostname - process_name - process_path - process_cmd_line - process_hash_sha256 - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, process_name, process_path, process_cmd_line, process_hash_sha256, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND (LOWER(process_path) LIKE '%\users\%' OR LOWER(process_path) LIKE '%\downloads\%' OR LOWER(process_path) LIKE '%\temp\%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## gate-read ```agent target=hunter cite: required context: - masqueraded-installer-lead max_iterations: 3 objective: Review the process executions in masqueraded-installer-lead. Determine if the filenames (e.g. including 'Zoom', 'PDF', 'ECARD', 'INVITATION') combined with the RMM version string 'v2.5.0.67' indicate a social-engineering lure. success_criteria: A verdict of suspicious for any host showing masqueraded RMM execution from a user profile. tools: - endpoint ``` ## gate-decision if~: "the gate-read verdict is suspicious for at least one host" (confidence: high, judge=hunter) then: → parallel-fanout indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-process-events) else: → close-out ## parallel-fanout parallel: - → service-persistence - → installer-rarity join: → final-triage ## service-persistence Find evidence of successful RMM service installation following the lead execution. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Creation of RMM.Agent or RMM.Agent.Launcher services. Silence suggests elevation or installation failed. reads: - device_hostname - service_name - service_cmd_line - actor_user_name - time silence: not_evidence_of_absence source: hb_service_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT device_hostname, service_name, service_cmd_line, actor_user_name, time FROM hb_service_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(service_name) LIKE 'rmm.agent%' OR LOWER(service_cmd_line) LIKE '%rmm agent%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## installer-rarity Determine if the suspicious binary name or hash is rare across the fleet, which distinguishes targeted lures from wide software updates. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, rmm_hashes=rmm_hashes, rare_threshold=rare_threshold) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A stack-count showing the binary is unique or extremely rare. Silence on rarity suggests a broader, potentially legitimate deployment. prevalence: by: device_hostname key: - name rare_below: 5 reads: - process_name - device_hostname - process_hash_sha256 - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-15' ~~~ SELECT LOWER(process_name) AS name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%_rmm_v2.5.0.67_%' OR instr(',' || '{{rmm_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING hosts <= {{rare_threshold}} ``` ## final-triage ```agent target=hunter cite: required context: - gate-read - service-persistence - installer-rarity max_iterations: 5 objective: Determine if any host has been successfully compromised via a masqueraded MSP360 installer. Correlate the suspicious execution identified in gate-read with the service creation and installer rarity. success_criteria: A verdict of malicious for hosts showing the phishing lure followed by service persistence and binary rarity. tools: - endpoint ``` ## route-on-verdict if~: "the final-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → contain-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-service-telemetry) else: → close-out ## contain-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the endpoint. Stop and delete the RMM.Agent and RMM.Agent.Launcher services. Collect the installer binary from the user's profile for forensic analysis. ``` → analyst-review ## analyst-review ```manual target=analyst Review the lead and service rows. Specifically check if RMM.Agent.exe spawned PowerShell to download ClientSetup.msi, which indicates the second remote access channel has been deployed. ``` → close-out ## close-out ```manual target=analyst Record the examined hosts and findings. Document any legitimate MSP360 use cases to update the excluded scope for future periodic runs. ``` → end