Because RMM tools are dual-use software, their presence is not inherently malicious, complicating detection efforts. This intelligence focuses on identifying the specific activity chain where a file of type .msi, originating from a non-reputable internet location, is executed via the Windows Installer process (msiexec.exe), followed shortly by the creation of known RMM-related service or agent executables. Defenders should treat such sequences as potential unauthorized persistence attempts, particularly when the installation was not initiated through managed IT or internal software distribution channels.

Impact

Successful deployment of RMM tools by unauthorized actors leads to complete loss of confidentiality and integrity on the impacted host. Attackers use these tools for file exfiltration, remote command execution, and as a springboard for further lateral movement within corporate networks. These campaigns have been observed across various sectors as attackers aim to maintain long-term, stealthy access to internal resources.

Recommendation

Detection engineering teams should implement monitoring for the specific sequence of MSI execution followed by RMM agent creation.

• Deploy the provided ESQL detection logic to identify the correlation between internet-sourced MSI downloads and RMM binary creation.
• Establish a baseline for authorized IT RMM deployment to differentiate legitimate administrative activity from unauthorized installations.
• Block or monitor downloads from untrusted domains that frequently host these installers, particularly those outside of known developer artifact and cloud storage services.
• Audit endpoint logs to verify the parent process for all msiexec.exe executions to ensure they align with established software deployment policies.