--- analysis: This is a hunt because detection rules for legitimate software like Rippling or ScreenConnect often trigger excessive noise. This hunt correlates the social engineering lure (DNS), the enrollment (rare registry keys), and the C2 activity (relay traffic) into a single phased attack chain triage. blind_spots: - id: no-agent-on-endpoint question: whether the MDM agent was installed on an unmanaged or BYOD device requires: endpoint agent coverage for all devices risk: A device without our endpoint agent will not report registry, file, or network activity, leaving the enrollment invisible until it touches the network fabric. stage: mdm-agent-installation - id: mdm-tenant-logs question: which specific MDM tenant and attacker account were used to manage the device requires: API access to the MDM provider's audit logs risk: We can see the presence of the agent but cannot see the attacker's console activity (e.g., commands issued) without native provider logs. coverage: - stage: phishing-initial-access status: covered steps: - dns-phishing-lookups - lure-file-hits - stage: mdm-agent-installation status: covered steps: - identify-mdm-software - lure-file-hits - stage: mdm-enrollment-persistence status: covered steps: - mdm-registry-stack - stage: rogue-rmm-deployment status: covered steps: - rmm-relay-connections guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Legitimate MDM platforms provide a trusted, privileged path for software deployment that bypasses most endpoint security alerts. A negative result confirming no unauthorized enrollments is a high-value security assurance. methodology: model-assisted trigger: intel-report hypothesis: An attacker uses social engineering to enroll a device into an unauthorized MDM tenant, providing a persistent and privileged path to deploy a rogue RMM tool for remote access. labels: - hunt - attack.t1566 - attack.t1204.002 - attack.t1112 - attack.t1219 - command and control - execution - initial access - persistence name: Rogue MDM and RMM Deployment parameters: lookback_days: default: '14' description: Days of history to examine. type: number lure_keywords: default: - edocusign_installer.msi - enroll14.php description: Specific file or resource names associated with the lures. from: kind: article observed: '2026-10-28' ref: huntress-mdm-malice type: list[string] phishing_domains: default: - webdocusign.viewportal.es - teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com description: Lure domains identified in the research. from: kind: article observed: '2026-10-28' ref: huntress-mdm-malice type: list[domain] rmm_relays: default: - relay.bobdthjau.com - relay.pronconetydesire.online description: Attacker-controlled ScreenConnect relays. from: kind: article observed: '2026-10-28' ref: huntress-mdm-malice type: list[domain] scope_hosts: default: [] description: Hostnames to focus the follow-on investigation; leave empty to hunt the whole estate. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/attackers-turn-mdm-into-remote-access gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start by identifying all hosts with Rippling or Hexnode agents. In many environments, these will be absent, making any hit suspicious. Focus on endpoints where users might be lured by business proposals or meeting invites. references: - name: "Huntress \u2014 Attackers Turn MDM into Remote Access" url: https://www.huntress.com/blog/attackers-turn-mdm-into-remote-access related: - hunt: unauthorized-rmm-detection reason: A broader hunt for RMM tools that does not focus on the MDM delivery vector. relation: sibling scenario: stages: - name: Phishing via Business-Themed Lures observables: - webdocusign.viewportal.es - teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham.com - index.php - enroll14.php slug: phishing-initial-access tactic: initial-access techniques: - T1566 - name: Malicious MDM Agent Installation observables: - eD0cuSign_Installer.msi - C:\Windows\System32\config\systemprofile\AppData\Local\mdm\{GUID}.msi - C:\Rippling\daemon.exe - Hexnode Gateway slug: mdm-agent-installation tactic: execution techniques: - T1204.002 - name: MDM Enrollment and Persistence observables: - Rippling enrollment registry key slug: mdm-enrollment-persistence tactic: persistence techniques: - T1112 - name: ScreenConnect Deployment via MDM observables: - ScreenConnect - relay.bobdthjau.com - relay.pronconetydesire.online - port 8041 slug: rogue-rmm-deployment tactic: command-and-control techniques: - T1219 summary: Attackers leverage business-themed phishing lures to trick users into installing or enrolling in rogue MDM platforms like Hexnode and Rippling. Once enrolled, the attackers use the MDM's administrative privileges to deploy ScreenConnect RMM agents, providing persistent remote access to the compromised endpoints. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # Rogue MDM and RMM Deployment This hunt examines the abuse of legitimate Mobile Device Management (MDM) platforms like Hexnode and Rippling. Attackers use business-themed phishing lures, such as fake DocuSign installers or Teams meeting invitations, to facilitate enrollment. Once enrolled, the MDM platform is used to deploy ScreenConnect agents that connect to attacker-controlled relays. The hunt follows a phased flow: first identifying MDM software presence and suspicious enrollment registry keys, then searching for the phishing lure execution and outbound RMM network traffic on non-standard ports. This correlation across identity, registry, and network telemetry distinguishes malicious use of these tools from legitimate administration. ## identify-mdm-software Scope the investigation to hosts running Hexnode or Rippling software, which are the platforms observed in this campaign. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames with MDM software. Silence means these platforms are not present in the estate. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%rippling%' OR LOWER(package_name) LIKE '%hexnode%' OR LOWER(vendor_name) LIKE '%rippling%' OR LOWER(vendor_name) LIKE '%hexnode%' ``` ## early-stage-parallel parallel: - → dns-phishing-lookups - → mdm-registry-stack join: → read-early-signals ## dns-phishing-lookups Match host activity against the lookalike Teams and DocuSign domains used to deliver the MDM installers. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts, phishing_domains=phishing_domains) ~~~yaml expected: Any resolution of these domains by a scoped host. Silence may mean the attacker used different domains or the logs have expired. reads: - device_hostname - process_name - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{phishing_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') ``` ## mdm-registry-stack Find rare MDM enrollment keys that stand out from the normal management baseline of the fleet. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rippling or Hexnode keys appearing on only a few hosts, which is suspicious in an estate that does not use them for primary management. prevalence: by: device_hostname key: - reg_key_path rare_below: 3 reads: - reg_key_path - device_hostname - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT reg_key_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_registry_activity WHERE (LOWER(reg_key_path) LIKE '%rippling%' OR LOWER(reg_key_path) LIKE '%hexnode%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY reg_key_path HAVING host_count <= 3 ``` ## read-early-signals ```agent target=hunter cite: required context: - identify-mdm-software - dns-phishing-lookups - mdm-registry-stack max_iterations: 3 objective: Identify hosts that resolved phishing domains and subsequently showed rare MDM-related registry modifications. success_criteria: A per-host verdict of suspicious if the DNS and registry signals align. tools: - endpoint - network ``` ## follow-on-parallel parallel: - → lure-file-hits - → rmm-relay-connections join: → final-attack-chain-triage ## lure-file-hits Find host evidence of the specific installer files named in the research using the lure_keywords list. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts, lure_keywords=lure_keywords) ~~~yaml expected: File create or open events for the phishing lure installers. Any row is a high-confidence match for the delivery stage. reads: - device_hostname - file_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{lure_keywords}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rmm-relay-connections Identify outbound connections to the reported ScreenConnect relays or the common relay port 8041. ```sqlite target=network role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, rmm_relays=rmm_relays) ~~~yaml expected: Outbound traffic identifying the RMM command-and-control stage. Silence means the relays have rotated or the tool is dormant. reads: - device_hostname - process_name - dst_endpoint_hostname - dst_endpoint_port - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, process_name, dst_endpoint_hostname, dst_endpoint_port, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (dst_endpoint_port = 8041 OR instr(',' || '{{rmm_relays}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## final-attack-chain-triage ```agent target=hunter cite: required context: - read-early-signals - lure-file-hits - rmm-relay-connections max_iterations: 5 objective: Determine if any host shows the complete sequence from phishing lure execution to rogue MDM enrollment and RMM C2 communication. success_criteria: A final verdict of malicious | suspicious | benign per host. tools: - endpoint - network ``` ## route-on-verdict if~: "the final-attack-chain-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-verification unavailable: → analyst-verification (blind_spot: no-agent-on-endpoint) else: → analyst-verification ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. After isolation, remove the unauthorized MDM management profile and uninstall any rogue ScreenConnect agents. ``` → analyst-verification ## analyst-verification ```manual target=analyst Verify the cited rows from the final triage. Check internal IT documentation to see if Rippling or Hexnode was recently adopted or used by a specific department. If not authorized, proceed with incident response. ``` → close-out ## close-out ```manual target=analyst Log the examined hosts. If any were found to be legitimately running these MDM tools, update the authorized software inventory to prevent future false positives. ``` → end