Attack Chain

1. Initial Access: A user falls victim to a phishing email or exploits an internet-facing vulnerability, allowing an attacker to gain an initial foothold on a system.
2. Execution & Staging: Malicious code is executed, often disguised as a legitimate application or utility, which may download further tools or scripts.
3. RMM Tool Deployment: The attacker deploys a legitimate, but often unauthorized or cracked, RMM or remote access client on the compromised system. This could be done through direct installation or by leveraging existing system capabilities.
4. Command and Control (C2) Initialization: The newly deployed RMM client attempts to establish a connection to its control server, which involves performing DNS queries to its service domains (e.g., teamviewer.com, anydesk.com, connectwise.com).
5. Persistent Remote Access: Successful connection to the RMM domain provides the attacker with persistent remote access to the compromised system, often bypassing traditional firewall rules due to the nature of RMM applications.
6. Internal Reconnaissance & Lateral Movement: Using the RMM tool, the attacker conducts internal reconnaissance, maps the network, and moves laterally to other systems within the environment.
7. Objective Achievement: The attacker executes their final objectives, which may include data exfiltration, deployment of ransomware, or further propagation of malware.

Impact

The abuse of RMM tools by threat actors can lead to severe organizational impact. Successful exploitation can result in unauthorized, persistent access to critical systems, enabling extensive data exfiltration of sensitive information, deployment of ransomware causing significant operational disruption and financial losses, or complete network compromise. Organizations across all sectors, particularly those relying on legitimate RMM for IT support, are susceptible. If the attack succeeds, it can undermine an organization's security posture, lead to regulatory non-compliance, and damage reputation.

Recommendation

• Deploy the provided Sigma rule (or its ESQL equivalent) to your SIEM/endpoint security platform and tune for your environment to detect suspicious DNS queries.
• Ensure that DNS query logging is enabled for all Windows endpoints, ideally via Sysmon Event ID 22 or Elastic Defend, to provide the necessary telemetry for the detection rule.
• Investigate all alerts generated by the Detect DNS Query to Remote Monitoring/Management (RMM) Domain from Non-Browser Process rule, focusing on the process.executable and its parent process.
• Review the code signatures (process.code_signature) of flagged processes to verify legitimacy and prevent abuse of trojanized RMM installers.
• Block the RMM domains listed in the IOC table at the DNS resolver and firewall levels for any systems not explicitly authorized to use such tools.
• Implement and enforce a strict policy for approved RMM tools and publishers, ensuring only authorized staff use managed, legitimate software for remote support.

Attack Chain

This detection focuses on identifying suspicious activity rather than a specific multi-stage attack chain. The presence of multiple RMM tools from distinct vendors typically occurs during the post-compromise phase, as attackers establish persistence and redundant command and control.

Impact

If not investigated and addressed, the presence of multiple, potentially unauthorized, remote management tools can lead to severe consequences. Attackers often deploy additional RMM tools to maintain persistence and establish redundant command and control channels, even after their primary access might be remediated. This increases the risk of data exfiltration, further lateral movement, deployment of ransomware, and long-term compromise of the affected host and wider network. Uncontrolled RMM installations also present a significant attack surface due to their elevated privileges and network access capabilities, making the host a critical pivot point for further malicious activities.

Recommendation

• Deploy the described detection logic to identify hosts exhibiting simultaneous process execution from multiple RMM vendors.
• Enable Sysmon Event ID 1 (Process Creation) and Windows process creation logging across your environment to ensure comprehensive coverage for process start events.
• Investigate alerts related to MITRE ATT&CK technique T1219 (Remote Access Software) to determine legitimacy.
• For hosts triggering this detection, immediately investigate the Esql.vendors_seen and Esql.processes_executable_values fields to identify the specific tools involved.
• For servers or standard user endpoints, treat such alerts as high risk; review install sources, code signatures, and recent logons for the involved processes.
• Correlate alerts with other suspicious activities (e.g., ingress tool transfer, suspicious scripting, new persistence mechanisms) on the same host.
• Establish and enforce a clear policy for approved RMM software, ideally limiting to a single approved stack per asset class to reduce false positives and attack surface.