← All Chokepoints HIGH

Renamed RMM Tools

Command and Control T1219.002 Detection difficulty: MEDIUM Prevalence: HIGH

Legitimate remote management and monitoring (RMM) tools are renamed or masqueraded to appear as trusted applications (tax documents, invoices, IT support tools) and delivered via browser download. Once executed, the RMM establishes persistent command-and-control to attacker infrastructure while appearing to be a signed, legitimate binary. Because the binary is legitimately signed by the vendor, many security tools will not flag it. The chokepoint is the browser download, file masquerading, user execution, and outbound connection to RMM infrastructure — all of which are required regardless of which RMM tool is used.

By @iimp0ster · Updated 2026-03-07 · View source YAML

Prerequisites (Environmental)

  • ✓ User account can execute binaries from browser download paths (Downloads, Temp, AppData)
  • ✓ RMM binary carries a valid vendor code-signing certificate — hash-based detection does not fire

Variations

Tools and methods that exploit this chokepoint — the list grows; the chokepoint doesn't change:

AnyDesk Declining
2020

Declining; February 2024 production breach revoked signing cert, driving actor migration

TeamViewer Active
2019

Common masquerade names: update.exe, system_check.exe

ScreenConnect (ConnectWise) Active
2022

Primary renamed-binary choice; CVE-2024-1709 also enables direct server exploitation

Source →
UltraViewer Active
2023

Low name recognition makes it credible as a disguised security tool

RustDesk Active
2023

Open-source; self-hosted infrastructure makes domain-based blocking ineffective

SimpleHelp Active
2025-Q1

Three critical CVEs exploited as ransomware initial access since January 2025

Source →
NetSupport Manager Active
2019

Long-abused via ClickFix clipboard delivery; remains common in commodity phishing

Atera Active
2022

Used by MuddyWater in nation-state campaigns since mid-2022

RMM-to-RMM Deployment Active
2024

First RMM deploys a second for redundancy; removes single point of C2 failure

Detection Strategy

Build detections iteratively. Start broad to understand your baseline, then tighten to production-ready.

Goal: Identify all RMM tool processes running in the environment

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Windows Security Event ID 4688 (Process Creation)
  • Application inventory / software management telemetry

FP Rate: High

Use Case: Asset inventory; baseline of legitimate RMM usage by IT staff

Detection Logic

Process name matches known RMM tool executables:
  anydesk.exe OR screenconnect*.exe OR teamviewer*.exe OR
  ultraviewer.exe OR rustdesk.exe OR meshagent.exe OR
  connectwisecontrol*.exe
Sigma Rule — Research Level
View on GitHub Download 
title: Known RMM Tool Process Execution
id: b8c2d4e6-f8a0-4b2c-9d3e-5f7a9b1c3d5e
status: experimental
description: >
  Detects execution of known Remote Management and Monitoring (RMM) tool processes.
  Research-level rule for baselining RMM tool usage across the environment. High false
  positive rate expected due to legitimate IT use. Use to establish a baseline of
  approved RMM instances before promoting to hunt-level detection.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.research
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\teamviewer.exe'
      - '\ultraviewer.exe'
      - '\UltraViewer.exe'
      - '\rustdesk.exe'
      - '\RustDesk.exe'
      - '\meshagent.exe'
      - '\MeshAgent.exe'
    Image|contains:
      - '\ScreenConnect.'
      - '\connectwisecontrol'
      - '\ConnectWiseControl'
  condition: selection
falsepositives:
  - Legitimate IT helpdesk use of RMM tools
  - Authorized remote support sessions
  - Security testing environments
level: informational

Goal: Detect RMM tool binaries downloaded via browser and executed within minutes

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 11 (File Creation)
  • Browser download telemetry

FP Rate: Medium

Use Case: Hunt for user-initiated RMM downloads; distinguishes IT-deployed from user-downloaded

Detection Logic

File Created: *.exe Creating Process: chrome.exe OR firefox.exe OR msedge.exe OR iexplore.exe OR brave.exe File Path: \Downloads\ OR \Temp\ OR \AppData\Local\Temp\ Then: Process execution within 5 minutes AND: Product metadata OR original filename matches known RMM vendor
Sigma Rule — Hunt Level
View on GitHub Download 
title: RMM Tool Downloaded via Browser and Executed
id: c9d3e5f7-a9b1-4c3d-5e6f-7a8b9c0d1e2f
status: experimental
description: >
  Detects RMM tool executables created by a web browser in a download location
  (Downloads or Temp directory). Hunt-level rule targeting the renamed RMM tool
  chokepoint: legitimate but renamed RMM binaries delivered via browser download
  as part of social engineering campaigns. Distinguishes user-initiated downloads
  from IT-deployed RMM installations.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.hunt
logsource:
  category: file_event
  product: windows
detection:
  selection_download_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\AppData\Roaming\Temp\'
  selection_browser_creator:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
      - '\vivaldi.exe'
  selection_executable:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
  condition: selection_download_path and selection_browser_creator and selection_executable
falsepositives:
  - Legitimate software downloads by users (any browser-downloaded executable)
  - IT staff downloading RMM tools for authorized deployment
level: low

Goal: Masqueraded RMM tool with campaign-themed name, downloaded by browser, with immediate outbound connection

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 3 (Network Connection)
  • Sysmon Event ID 11 (File Creation)
  • File metadata / version info analysis

FP Rate: Low

Use Case: SOC alerting; campaign-themed file name detection catches targeted pretexts

Detection Logic

File Created: *.exe via browser (see Hunt logic above) AND one of:
  - File Name contains: "tax" OR "invoice" OR "SSN" OR "SSA" OR "support" OR "verify" OR "secure"
  - File Metadata: OriginalFilename = "anydesk.exe" (or other RMM) but current name differs
  - File Signer: Known RMM vendor certificate on file with non-RMM name
Network: Outbound connection to RMM infrastructure within 2 minutes of execution UserContext: Standard user account (not in IT admin group)
Sigma Rule — Analyst Level
View on GitHub Download 
title: Masqueraded RMM Tool with Campaign-Themed Filename Downloaded via Browser
id: d0e4f6a8-b0c2-4d4e-6f7a-8b9c0d1e2f3a
status: experimental
description: >
  High-fidelity detection for renamed RMM tools delivered via browser download using
  social engineering pretexts (tax, invoice, SSN/SSA, IT support). Detects when an
  executable with a campaign-themed name is downloaded by a browser and contains
  file metadata (OriginalFilename or signer) matching a known RMM vendor. This
  combination of deceptive naming and legitimate signing is a strong indicator of
  the renamed RMM tool technique.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  # Executable downloaded from browser to user-writable location
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\Desktop\'
  # Campaign-themed filename patterns (tax season, invoice, IT support pretexts)
  selection_campaign_name:
    Image|contains:
      - 'tax'
      - 'invoice'
      - 'Invoice'
      - 'Tax'
      - 'SSN'
      - 'SSA'
      - 'W-2'
      - 'W2'
      - '1099'
      - 'refund'
      - 'Refund'
      - 'support'
      - 'Support'
      - 'verify'
      - 'Verify'
      - 'secure'
      - 'Secure'
      - 'helpdesk'
      - 'HelpDesk'
      - 'IT_'
      - 'remote_'
  # Original filename or description matches known RMM vendors
  # (requires file metadata enrichment — Sysmon FileVersion fields or EDR metadata)
  selection_rmm_metadata:
    OriginalFileName|contains:
      - 'AnyDesk'
      - 'anydesk'
      - 'ScreenConnect'
      - 'screenconnect'
      - 'TeamViewer'
      - 'teamviewer'
      - 'UltraViewer'
      - 'ultraviewer'
      - 'RustDesk'
      - 'rustdesk'
      - 'MeshAgent'
      - 'meshagent'
  condition: selection_path and selection_campaign_name and selection_rmm_metadata
falsepositives:
  - Legitimate tax or invoice software that happens to have RMM integration
  - IT staff downloading RMM tools with descriptive names for asset tracking
level: high

Early Detection Layers

Detect before the user pastes or executes — earlier in the kill chain than the Sysmon-based rules above, using different data sources.

OSINT Sources

URLScan filename:tax*.exe OR filename:invoice*.exe OR filename:ssn*.exe OR filename:support*.exe OR filename:verify*.exe

Finds download pages serving tax/invoice/support-themed executables; extend with seasonal pretexts during relevant periods.

 Shodan product:"ScreenConnect"

Find internet-exposed ScreenConnect instances; cross-reference against known legitimate MSP infrastructure to identify attacker-controlled deployments.

 Censys services.tls.certificate.parsed.subject.common_name: "SimpleHelp"

Finds infrastructure presenting SimpleHelp TLS certificates — currently the most actively exploited RMM platform per CISA AA25-163A.

 VirusTotal Intelligence have:itw tag:peexe (metadata:"AnyDesk" OR metadata:"ScreenConnect" OR metadata:"SimpleHelp" OR metadata:"NetSupport")

Requires VT Intelligence subscription; finds PE executables in the wild whose internal metadata references known RMM vendors — the core renamed-binary delivery mechanism.

 LOLRMM

Community-maintained catalog of every known RMM tool with file metadata, network indicators, and detection heuristics for building renamed-binary analyst rules.

Intel Resources

Related Chokepoints

ClickFix Techniques HIGH Remote Execution Tools (HackTools) HIGH