A Series of Unfortunate (RMM) Events

Summary

Threat actors are increasingly misusing legitimate remote monitoring and management (RMM) software to obtain initial access and retain persistence in targeted environments. The report highlights incidents where operators first installed a “primary” RMM tool—such as GoTo Resolve or PDQ—then followed up by deploying additional RMM utilities like ScreenConnect, SimpleHelp, or ITarian. The initial installers were commonly delivered through phishing and social engineering, often hosted on attacker-controlled domains. Because these are trusted commercial tools, their abuse can blend into normal admin activity and support long-lived footholds.

Investigation

Huntress SOC conducted retrospective threat hunting across endpoint telemetry and identified execution chains beginning with phishing-delivered installers for GoTo Resolve, PDQ, or ITarian. Analysts then traced the persistence and expansion steps, including scheduled task creation, service installation/starts, and filesystem paths used to stage and deploy secondary RMM binaries such as ScreenConnect and SimpleHelp. Supporting evidence—including VirusTotal parent-process execution context and local filesystem artifacts—was used to reconstruct the multi-stage intrusion flow.

Mitigation

Implement application allowlisting and explicitly block unapproved RMM tools, particularly those executed from temporary or user-writable directories. Monitor for scheduled tasks and service creation events tied to common RMM products and scrutinize outbound traffic to newly registered or suspicious domains. Maintain a current inventory of sanctioned RMM software and routinely audit where, how, and by whom these tools are used.

Response

If a rogue RMM installer is identified, isolate the endpoint, stop and remove associated services and scheduled tasks, and delete the unauthorized binaries. Block or sinkhole attacker-controlled domains and URLs observed during delivery and C2 communications. Complete a full forensic validation to confirm no additional persistence remains, and tune detections to surface similar “primary-to-secondary RMM” deployment patterns going forward.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An adversary sends a phishing email with an attachment named Open Revised Contract (2).exe. A user, believing the file to be a legitimate contract, clicks the attachment. The executable drops a malicious RMM MSI (276Special%10Invitation9756.msi) into the %TEMP% directory and launches it via msiexec.exe. The MSI installs a rogue RMM service that opens a reverse‑shell to the attacker’s C2. This flow maps to:

  1. T1203 – Client execution (user runs the attached EXE).
  2. T1027.004 – Compiled payload (the EXE is a compiled malicious binary).
  3. T1218.005 – Msiexec (the EXE uses msiexec.exe /i to run the MSI).
  4. T1554 – Compromise client software binary (the MSI installs the rogue RMM).

  The process creation events generated are:

  • C:Users<user>AppDataLocalTempOpen Revised Contract (2).exe – the initial malicious EXE.
  • C:WindowsSystem32msiexec.exe with command line /i "C:Users<user>AppDataLocalTemp276Special%10Invitation9756.msi" /quiet.

  Both paths match entries in the Sigma rule and should fire an alert.

• Regression Test Script:

  # ------------------------------------------------------------
  # Simulation script – triggers the Sigma rule using the exact
  # filenames defined in the detection logic.
  # ------------------------------------------------------------
  $tempDir = "$env:TEMPRMM_Test"
  New-Item -Path $tempDir -ItemType Directory -Force | Out-Null
  
  # 1. Drop fake malicious EXE (simulated by copying notepad.exe)
  $malExe = "$tempDirOpen Revised Contract (2).exe"
  Copy-Item -Path "$env:SystemRootSystem32notepad.exe" -Destination $malExe -Force
  
  # 2. Drop fake malicious MSI (simulated by copying any MSI – e.g., Windows SDK)
  $malMsi = "$tempDir276Special%10Invitation9756.msi"
  # Creating an empty placeholder MSI file
  New-Item -Path $malMsi -ItemType File -Force | Out-Null
  
  # 3. Execute the EXE – it will in turn launch msiexec to install the MSI
  Write-Host "[*] Executing malicious EXE..."
  Start-Process -FilePath $malExe -Wait
  
  # 4. Directly launch the MSI via msiexec to ensure detection (if step 3 failed)
  Write-Host "[*] Launching MSI via msiexec..."
  $msiArgs = "/i `"$malMsi`" /quiet"
  Start-Process -FilePath "$env:SystemRootSystem32msiexec.exe" -ArgumentList $msiArgs -Wait
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts on the two process creations."
  # ------------------------------------------------------------
  # Cleanup (run separately if desired)
  # ------------------------------------------------------------
  # Remove-Item -Path $tempDir -Recurse -Force

• Cleanup Commands:

  # Remove all artifacts created by the simulation
  $tempDir = "$env:TEMPRMM_Test"
  if (Test-Path $tempDir) {
      Remove-Item -Path $tempDir -Recurse -Force
      Write-Host "[*] Cleanup completed."
  } else {
      Write-Host "[!] No artifacts found; nothing to clean."
  }