Potential RMM Execution from a Commonly Abused Web Service

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "ES|QL FROM subqueries require Elastic Stack 9.5.0 or later."
  6min_stack_version = "9.5.0"
  7updated_date = "2026/10/22"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management
 13(RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver
 14remote-access software during social engineering and intrusion campaigns.
 15"""
 16false_positives = [
 17    "Publishers in the maintained signer list may also sign scanners, backup clients, or other non-RMM software. Confirm the actual product and purpose from executable, command-line, hash, and deployment evidence.",
 18    "IT or managed service providers may distribute RMM binaries through public hosting or shared download links. Confirm the package, host, operator, timing, and enrollment destination against a change record or support ticket.",
 19]
 20from = "now-25m"
 21interval = "5m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Potential RMM Execution from a Commonly Abused Web Service"
 25note = """ ## Triage and analysis
 26
 27> **Disclaimer**:
 28> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 29
 30### Investigating Potential RMM Execution from a Commonly Abused Web Service
 31
 32This rule detects signed remote monitoring software launched on Windows after delivery from a commonly abused hosting or file-sharing service, which may indicate covert remote access despite the software appearing legitimate. An attacker may send a user a social-engineering link to download a trusted remote-support executable, then launch it to establish interactive control while blending with legitimate administration activity.
 33
 34### Possible investigation steps
 35
 36- Confirm whether the RMM product, executing user, device, and observed timeframe align with approved software inventory, help-desk activity, or authorized administrator actions.
 37- Reconstruct the delivery chain using browser, email, proxy, and file telemetry to identify the initiating link, sender, download time, and any social-engineering context.
 38- Review the process ancestry, command line, descendants, and nearby persistence changes for scripted installation, unattended-access configuration, credential access, or shell execution.
 39- Correlate DNS, network, and firewall telemetry with vendor infrastructure and extract available session identifiers, configuration artifacts, or remote operator details.
 40- Hunt enterprise-wide for the same hash, executable path, source URL, user, and related destinations, then isolate affected hosts and remove unauthorized access mechanisms if malicious activity is confirmed.
 41
 42### False positive analysis
 43
 44- An authorized help-desk technician may download and run approved RMM software from a listed file-sharing or hosting domain, which can be confirmed against support tickets, administrator activity, and the approved software inventory.
 45- An approved software deployment may retrieve a signed RMM installer from organization-controlled cloud storage, which can be validated by reviewing the origin URL, code-signature trust, file hash, deployment timing, and change records.
 46
 47### Response and remediation
 48
 49- Isolate affected Windows hosts from the network while preserving endpoint evidence, including the RMM executable, process tree, command line, source URL, configuration files, and network connections.
 50- Terminate unauthorized RMM sessions and remove associated executables, services, scheduled tasks, startup entries, registry run keys, unattended-access settings, and newly created accounts or access tokens.
 51- Escalate immediately to incident response if the RMM accessed privileged accounts, executed shells or credential tools, moved laterally, established persistence, or appeared on multiple systems.
 52- Reset credentials and revoke active sessions for affected users and administrators, then block confirmed malicious hashes, download URLs, domains, and remote-service destinations across endpoint, web, DNS, email, and firewall controls.
 53- Reimage compromised hosts or restore them from a verified known-good baseline, patch affected software, and validate that no unauthorized RMM components, accounts, persistence artifacts, or outbound connections remain before reconnecting them.
 54- Prevent recurrence by allowlisting approved RMM products and deployment sources, restricting installation and unattended-access configuration to authorized administrators, and monitoring for RMM downloads from public hosting or file-sharing services.
 55"""
 56references = [
 57    "https://www.huntress.com/blog/series-of-unfortunate-rmm-events",
 58    "https://www.cloudflare.com/cloudforce-one/research/report/vercel-hosted-rmm-abuse-campaign-evolves-with-telegram-c2-for-victim-filtering/",
 59    "https://www.cloudflare.com/cloudforce-one/research/new-ssa-themed-phishing-campaign-installs-trojanized-screenconnect/",
 60    "https://www.forescout.com/blog/from-urls-to-malware-how-threat-actors-abuse-domain-security-in-2025/",
 61    "https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access",
 62]
 63risk_score = 21
 64rule_id = "e06df914-e526-4a52-ab9d-0fd10d8015dd"
 65severity = "low"
 66tags = [
 67    "Domain: Endpoint",
 68    "OS: Windows",
 69    "Platform: Windows",
 70    "Rule Type: ES|QL",
 71    "Threat: Remote Management Tool Abuse",
 72    "Use Case: Threat Detection",
 73    "Tactic: Command and Control",
 74    "Data Source: Elastic Defend",
 75    "Resources: Investigation Guide",
 76]
 77timestamp_override = "event.ingested"
 78type = "esql"
 79
 80query = '''
 81// Union file and process rows. Then INLINE STATS attaches file-origin context for the host and path.
 82// File-origin fallback correlation is only used when process.origin_url is missing or empty.
 83FROM
 84(
 85  FROM logs-endpoint.events.file-*
 86  | WHERE KQL("event.action: creation") AND file.origin_url IS NOT NULL
 87  // Strip the terminal :Zone.Identifier ADS suffix and optional :$DATA stream type from the file path so we can correlate with the process event.
 88  | EVAL is_execution = false, origin_url = file.origin_url,
 89      executable_path = REPLACE(TO_LOWER(file.path), ":zone[.]identifier(:[$]data)?$", "")
 90),
 91(
 92  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
 93  | WHERE host.os.type == "windows" AND KQL("event.type: start")
 94  | WHERE process.code_signature.subject_name IN (
 95      "Action1 Corporation", "Aeroadmin LLC", "AeroAdmin LLC", "AmidaWare LLC", "Ammyy LLC", "AnyDesk Software GmbH",
 96      "AOMEI International Network Limited", "Atera Networks Ltd", "AWERAY PTE. LTD.", "BeamYourScreen GmbH",
 97      "Bomgar Corporation", "BreakingSecurity.net", "ConnectWise, Inc.", "ConnectWise, LLC", "Connectwise, LLC",
 98      "Devolutions Inc", "Devolutions inc.", "DOMOTZ INC.", "DUC FABULOUS CO.,LTD", "DWSNET OÜ", "DWSNET srl",
 99      "Electronic Team, Inc.", "Famatech Corp.", "FleetDeck Inc", "FLEETDECK INC.", "GlavSoft LLC", "GlavSoft LLC.",
100      "GoTo Technologies USA, LLC", "Hefei Pingbo Network Technology Co. Ltd", "IDrive, Inc.",
101      "Impero Solutions Limited", "IMPERO SOLUTIONS LIMITED", "Instant Housecall", "ISL Online Ltd.", "JumpCloud Inc",
102      "Level Software, Inc.", "LogMeIn, Inc.", "LUNIXAR SAS DE CV", "MMSOFT Design Ltd.", "Monitoring Client",
103      "MSPBytes Corp", "MSPBytes, Corp.", "N-ABLE TECHNOLOGIES LTD", "Nanosystems S.r.l.", "NetSupport Ltd",
104      "NetSupport Ltd.", "NETSUPPORT LTD.", "NinjaOne LLC", "NinjaRMM, LLC", "Open Source Developer, Huabing Zhou",
105      "Parallels International GmbH", "philandro Software GmbH", "Pro Softnet Corporation", "PURSLANE", "RealVNC",
106      "RealVNC Limited", "REMOTE UTILITIES PTE. LTD.", "Remote Utilities LLC", "Rocket Software, Inc.",
107      "Rsupport Co., Ltd.", "SAFIB", "ScreenConnect Client", "Servably, Inc.", "Servably Inc.", "ShowMyPC INC",
108      "SimpleHelp Ltd", "Splashtop Inc.", "Superops Inc.", "Tailscale Inc.", "TeamViewer", "TeamViewer GmbH",
109      "TeamViewer Germany GmbH", "Techinline Limited", "uvnc bvba", "Yakhnovets Denis Aleksandrovich IP",
110      "Zhou Huabing", "ZOHO Corporation Private Limited"
111    )
112  | EVAL is_execution = true, origin_url = process.origin_url, executable_path = TO_LOWER(process.executable)
113)
114
115// Both process.origin_url and file.origin_url are copied to the common origin_url variable in the subqueries.
116// So we can use the same logic for both the primary and fallback origin_url.
117| URI_PARTS origin = origin_url
118
119// Preserve executions with null/empty origin URLs so they can fall back to file origin if needed.
120| WHERE (is_execution AND (origin_url IS NULL OR origin_url == "")) OR
121    // Source code and developer artifact hosting.
122    TO_LOWER(origin.domain) LIKE (
123      "api.bitbucket.org", "bitbucket.org", "api.github.com", "gist.githubusercontent.com", "github.com",
124      "github-releases.githubusercontent.com", "objects.githubusercontent.com", "raw.githack.com",
125      "raw.githubusercontent.com", "rawcdn.githack.com", "release-assets.githubusercontent.com", "gitlab.com",
126      "*.gitlab.com", "notabug.org", "sourceforge.net", "*.sourceforge.net"
127    ) OR
128    // AWS S3 object storage.
129    TO_LOWER(origin.domain) LIKE (
130      "s3.amazonaws.com", "*.s3.amazonaws.com", "s3.*.amazonaws.com", "*.s3.*.amazonaws.com", "s3-*.amazonaws.com",
131      "*.s3-*.amazonaws.com", "*.s3express-*.amazonaws.com"
132    ) OR
133    // Azure, Cloudflare R2, Discord, and Dropbox.
134    TO_LOWER(origin.domain) LIKE (
135      "*.azurewebsites.net", "*.azurestaticapps.net", "*.azurecontainerapps.io", "*.blob.core.windows.net",
136      "*.blob.storage.azure.net", "*.web.core.windows.net", "*.web.storage.azure.net", "*.file.core.windows.net",
137      "*.azurefd.net", "*.azureedge.net", "*.r2.dev", "cdn.discordapp.com", "dropbox.com", "*.dropbox.com",
138      "dropboxusercontent.com", "*.dropboxusercontent.com"
139    ) OR
140    // Firebase Storage, Google Drive, and Cloud Storage.
141    TO_LOWER(origin.domain) LIKE (
142      "*.googleusercontent.com", "content-storage.googleapis.com", "firebasestorage.googleapis.com", "docs.google.com",
143      "drive.google.com", "drive.usercontent.google.com", "storage-download.googleapis.com", "storage.googleapis.com",
144      "*.storage.googleapis.com", "www.googleapis.com"
145    ) OR
146    // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
147    TO_LOWER(origin.domain) LIKE (
148      "api.onedrive.com", "files.1drv.com", "*.files.1drv.com", "onedrive.live.com", "*.onedrive.live.com",
149      "sharepoint.com", "*.sharepoint.com", "storage.live.com", "*.storage.live.com", "onehub.com", "*.onehub.com",
150      "onlyoffice.com", "*.onlyoffice.com", "pcloud.com", "*.pcloud.com", "files.slack.com", "slack-files.com",
151      "*.supabase.co", "s3.wasabisys.com", "*.s3.wasabisys.com", "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
152    ) OR
153    // Developer tunnels, reverse proxies, automation, and webhooks.
154    TO_LOWER(origin.domain) LIKE (
155      "devtunnels.ms", "*.devtunnels.ms", "localtunnel.me", "*.localtunnel.me", "n8n.cloud", "*.n8n.cloud",
156      "*.ngrok.app", "*.ngrok.dev", "*.ngrok-free.app", "*.ngrok-free.dev", "*.ngrok.io", "*.ngrok.pizza",
157      "*.ngrok.pro", "pagekite.me", "*.pagekite.me", "serveo.net", "*.serveo.net", "trycloudflare.com",
158      "*.trycloudflare.com", "webhook.site"
159    ) OR
160    // File-sharing and transfer services.
161    TO_LOWER(origin.domain) LIKE (
162      "4shared.com", "*.4shared.com", "*.4sync.com", "bashupload.com", "*.bashupload.com", "catbox.moe", "*.catbox.moe",
163      "easyupload.io", "*.easyupload.io", "file.io", "filebin.net", "filecloud.me", "files.fm", "*.files.fm",
164      "filetransfer.io", "*.filetransfer.io", "gofile.io", "*.gofile.io", "limewire.com", "*.limewire.com",
165      "mediafire.com", "*.mediafire.com", "mega.co.nz", "*.mega.co.nz", "mega.nz", "*.mega.nz", "pixeldrain.com",
166      "*.pixeldrain.com", "send.cm", "*.send.cm", "send.now", "*.send.now", "sendit.sh", "*.sendit.sh", "sendspace.com",
167      "*.sendspace.com", "share.riseup.net", "temp.sh", "tempsend.com", "transfer.sh", "ufile.io", "*.ufile.io",
168      "upload.ee", "*.upload.ee", "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net", "workupload.com"
169    ) OR
170    // CDN, paste, and public hosting services.
171    TO_LOWER(origin.domain) LIKE (
172      "*.alwaysdata.net", "blogspot.com", "*.blogspot.com", "b-cdn.net", "*.b-cdn.net", "cdnmegafiles.com",
173      "*.cdnmegafiles.com", "infinityfreeapp.com", "*.infinityfreeapp.com", "free.keep.sh", "*.netlify.app", "paste.ee",
174      "publicvm.com", "*.publicvm.com", "*.vercel.app", "*.*.workers.dev"
175    ) OR
176    // Decentralized and content-addressed storage.
177    TO_LOWER(origin.domain) LIKE (
178      "ar.io", "*.ar.io", "arweave.net", "*.arweave.net", "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io", "dweb.link",
179      "*.dweb.link", "gateway.pinata.cloud", "ipfs.io", "*.ipfs.io", "mypinata.cloud", "*.mypinata.cloud",
180      "nftstorage.link", "*.nftstorage.link", "storjshare.io", "*.storjshare.io", "web3.storage", "*.web3.storage"
181    )
182
183// For events where process.origin_url is missing or empty, we can look for file.origin_url values on the same host and path.
184| INLINE STATS Esql.file_origin_time = MIN(@timestamp) WHERE is_execution == false,
185    Esql.file_origin_urls = VALUES(origin_url) WHERE is_execution == false
186  BY host.id, executable_path
187// For fallback, at least one qualifying file event must happen at or before the process event.
188| WHERE is_execution AND (
189    (origin_url IS NOT NULL AND origin_url != "") OR @timestamp >= Esql.file_origin_time
190  )
191
192| KEEP @timestamp, _id, _version, _index, event.type, host.id, host.name, user.name,
193    process.entity_id, process.executable, process.command_line, process.hash.sha256,
194    process.code_signature.subject_name, process.code_signature.trusted, process.origin_url,
195    Esql.file_origin_time, Esql.file_origin_urls
196| SORT @timestamp DESC, _index ASC, _id ASC
197'''
198
199setup = """## Setup
200
201This rule requires Elastic Defend on Windows with process and file event collection, process code-signature metadata, and executable-origin URLs on process events or file creation events.
202
203Setup instructions: https://ela.st/install-elastic-defend
204"""
205
206[rule.investigation_fields]
207field_names = [
208    "host.name",
209    "user.name",
210    "process.executable",
211    "process.command_line",
212    "process.code_signature.subject_name",
213    "process.code_signature.trusted",
214    "process.hash.sha256",
215    "process.origin_url",
216    "Esql.file_origin_urls",
217    "Esql.file_origin_time",
218]
219
220[[rule.threat]]
221framework = "MITRE ATT&CK"
222
223[[rule.threat.technique]]
224id = "T1105"
225name = "Ingress Tool Transfer"
226reference = "https://attack.mitre.org/techniques/T1105/"
227
228[[rule.threat.technique]]
229id = "T1219"
230name = "Remote Access Tools"
231reference = "https://attack.mitre.org/techniques/T1219/"
232
233[[rule.threat.technique.subtechnique]]
234id = "T1219.002"
235name = "Remote Desktop Software"
236reference = "https://attack.mitre.org/techniques/T1219/002/"
237
238[rule.threat.tactic]
239id = "TA0011"
240name = "Command and Control"
241reference = "https://attack.mitre.org/tactics/TA0011/"