{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vnc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ScreenConnect Client","Action1 Corporation","AeroAdmin LLC","Ammyy LLC","AteraAgent.exe","AWERAY Remote","AweSun.exe","Bomgar Corporation","Domotz Agent","DWSNET","FleetDeck Commander","IDrive","IMPERO","Instant Housecall","ISL Online","LogMeIn, Inc.","Lunixar","MeshAgent.exe","NinjaRMM Agent","Parsec","Quick Assist","Radmin","Remote Desktop Manager","RemotePC","Remote Utilities","RustDesk","ScreenConnect","Splashtop","Superops","TeamViewer","Techinline","UltraVNC","UltraViewer","VNC","ZohoURS.exe","Velociraptor.exe","GoToResolve","Tailscale","Syncro","Connectwise ScreenConnect","Atera Networks Ltd"],"_cs_severities":["medium"],"_cs_tags":["rmm","remote_access","command_and_control"],"_cs_type":"advisory","_cs_vendors":["Action1 Corporation","AeroAdmin LLC","Ammyy LLC","Atera Networks Ltd","AWERAY PTE. LTD.","BeamYourScreen GmbH","Bomgar Corporation","DUC FABULOUS CO.,LTD","DOMOTZ INC.","DWSNET OÜ","FleetDeck Inc","GlavSoft LLC","Hefei Pingbo Network Technology Co. Ltd","IDrive, Inc.","IMPERO SOLUTIONS LIMITED","Instant Housecall","ISL Online Ltd.","LogMeIn, Inc.","LUNIXAR SAS DE CV","MMSOFT Design Ltd.","Nanosystems S.r.l.","NetSupport Ltd","NinjaRMM, LLC","Parallels International GmbH","philandro Software GmbH","Pro Softnet Corporation","RealVNC","Remote Utilities LLC","Rocket Software, Inc.","SAFIB","Servably, Inc.","ShowMyPC INC","Splashtop Inc.","Superops Inc.","TeamViewer","Techinline Limited","uvnc bvba","Yakhnovets Denis Aleksandrovich IP","ZOHO Corporation Private Limited","Connectwise, LLC","BreakingSecurity.net"],"content_html":"\u003cp\u003eAdversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This can allow attackers to maintain persistent access, execute commands remotely, and potentially deploy further malicious payloads. This detection identifies the first-time execution of processes associated with commonly abused RMM tools on a given host within a configurable history window. By detecting these first-time occurrences, defenders can identify potentially unauthorized or malicious use of RMM tools before they are used for more damaging activities. This rule leverages process names and code signature information to identify known RMM tools. The rule has been seen detecting abused tools since April 2023.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the target system (e.g., through phishing, exploitation of a vulnerability, or compromised credentials).\u003c/li\u003e\n\u003cli\u003eThe attacker installs a legitimate RMM tool or remote access software such as TeamViewer, AnyDesk, or ScreenConnect.\u003c/li\u003e\n\u003cli\u003eThe RMM tool is configured to allow remote access and control.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the RMM tool to establish a persistent connection to the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker executes commands remotely, potentially to gather information, move laterally, or install additional malware.\u003c/li\u003e\n\u003cli\u003eThe attacker may use the RMM tool to exfiltrate sensitive data from the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistence using the RMM tool, allowing continued access to the compromised system.\u003c/li\u003e\n\u003cli\u003eThe attacker deploys ransomware across the environment leveraging remote code execution capabilities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack involving the use of RMM tools can lead to significant damage, including data theft, system compromise, and financial loss. The use of RMM tools can also provide attackers with a persistent foothold in the network, allowing them to conduct long-term espionage or sabotage operations. Recent reports indicate that domain-wide ransomware has been deployed leveraging abused RMM tools. If successful, this attack can lead to complete data encryption and significant operational disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;First Time Seen Remote Monitoring and Management Tool\u0026quot; to your SIEM to detect the initial execution of RMM tools on hosts, and tune the 7-day history window for your environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rule, focusing on the process execution chain (parent process tree) to identify potentially malicious activity.\u003c/li\u003e\n\u003cli\u003eEnforce that only tooling approved by IT policy should be used for remote access purposes, and only by authorized staff.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging (e.g., Sysmon) with code signature monitoring on Windows endpoints to ensure the required data sources are available for detection.\u003c/li\u003e\n\u003cli\u003eConsider adding a rule exception for approved tools (e.g., Velociraptor) or excluding specific processes (e.g., \u003ccode\u003eprocess.name: \u0026quot;Velociraptor.exe\u0026quot;\u003c/code\u003e) to reduce false positives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-first-time-seen-rmm/","summary":"This rule detects the first time a remote monitoring and management (RMM) or remote access process is seen on a host within a defined history window, indicating potential command-and-control, persistence, or unauthorized remote access activity.","title":"First Time Seen Remote Monitoring and Management Tool Usage","url":"https://feed.craftedsignal.io/briefs/2024-01-03-first-time-seen-rmm/"}],"language":"en","title":"CraftedSignal Threat Feed - VNC","version":"https://jsonfeed.org/version/1.1"}