RMM Installed on Client PCs: MSP Alert

Key insights

• Attack overview: Attackers use phishing to deliver a legitimate, digitally signed RMM installer (observed: MSP360).
  When a user approves the UAC prompt the installer creates services that give attackers persistent remote access and often installs a second tool (observed: ScreenConnect) as a backup.


• Typical attack chain: Phishing message → user runs a signed installer → installer requests admin rights → installer runs PowerShell to pull additional remote tools → attackers gain at least two remote channels for persistence and lateral movement.


• Why this works: Signed, legitimate software looks trustworthy to users and many protections.
  Attackers exploit admin privileges, service persistence, and the low visibility of normal IT activity, making detection harder.


• Detection gaps: Microsoft research shows some hunts and detections don’t run by default on Microsoft 365 Business Premium.
  Web filters can block some payloads but signed installers and staged downloads often pass conventional antivirus checks.


• Practical mitigations: Add the Defender Suite add-on or equivalent EDR; run the provided advanced hunting query and deploy a custom detection rule to catch staged RMM installs.
  Apply strict conditional access and a one-page remote tools policy to limit who can install or approve remote-management software.


• MSP operations: Standardize detection and response across client tenants, monitor for second-stage tool installs, and train engineers and users to reject unexpected UAC prompts.
  Use centralized alerting and clear incident response steps to remove both primary and redundant RMM channels quickly.

Keywords

RMM tools, remote monitoring and management, RMM attacks, attacker-installed RMM, MSP security best practices, client PC compromise, supply chain attacks, ransomware via RMM