Skip to content
Threat Feed
Subscribe

Product

Atera Agent

2 briefs RSS
low advisory

Detection of RMM Software Deployment via Internet-Originated MSI Files

This detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.

Acronis Cyber Protect Connect +43 defense-evasion command-and-control windows rmm
1t
medium advisory

Multiple Remote Management Tool Vendors on Same Host

This detection identifies a Windows host where two or more distinct remote monitoring and management (RMM) or remote-access tool vendors are observed starting processes within the same eight-minute window, potentially indicating compromise, shadow IT, or attacker staging of redundant access.

AeroAdmin +55 command-and-control rmm windows threat-detection
3r