Skip to content
Threat Feed
Subscribe

Product

Nezha-Agent

3 briefs RSS
low advisory

Detection of RMM Software Deployment via Internet-Originated MSI Files

This detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.

Acronis Cyber Protect Connect +43 defense-evasion command-and-control windows rmm
1t
medium advisory

Suspicious Activity: Multiple Remote Management Tool Vendors on Same Host

This brief describes a behavioral detection for Windows hosts where two or more distinct remote monitoring and management (RMM) or remote-access tools from different vendors are observed starting processes within an eight-minute window, indicating potential compromise, shadow IT, or attacker staging of redundant access.

Acronis Cyber Protect Connect +49 command-and-control remote-access-software rmm windows behavioral-detection
1t
medium advisory

First Time Seen Remote Monitoring and Management Tool Detection

Adversaries are leveraging legitimate Remote Monitoring and Management (RMM) and remote access tools on Windows endpoints for command-and-control, persistence, and execution, with detection focusing on the first observed instance of these tools on a host.

AA +132 command-and-control persistence execution rmm remote-access windows
1r 3t 5i