RMM Software Installation from an Internet-Originated MSI

[metadata]
creation_date = "2026/08/07"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "FROM subquery support became generally available in 9.5.0"
min_stack_version = "9.5.0"
updated_date = "2026/09/18"

[rule]
author = ["Elastic"]
description = """
Identifies a Windows Installer package (MSI) originating from the internet, which when executed, installs a recognized
RMM product. Attackers use RMMs commonly in social engineering campaigns to gain access and control over the victim's
system. This rule does not establish that the origin, installer, or RMM product is inherently malicious. It also
excludes installations covered by the companion rule "RMM Software Installation from a Commonly Abused Web Service".
"""
false_positives = [
    """
    Authorized IT or managed service provider deployment of remote monitoring and management software through vendor,
    internal, or other software distribution infrastructure can produce this behavior.
    """,
]
from = "now-25m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "RMM Software Installation from an Internet-Originated MSI"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating RMM Software Installation from an Internet-Originated MSI

This rule detects when a recently downloaded MSI runs through Windows Installer and creates a recognized remote monitoring or management executable, a sequence that can establish persistent remote control. An attacker may use a phishing lure or fake support interaction to convince a Windows user to install the package, then operate the resulting remote-access agent for command execution, surveillance, or additional payload delivery.

### Possible investigation steps

- Assess the download URL, referrer, domain age and reputation, and surrounding proxy or browser activity to determine how the user obtained the installer.
- Validate the MSI hash, digital signature, certificate chain, product metadata, and expected vendor distribution channel, and compare them with approved software inventory and threat intelligence.
- Reconstruct the user and process timeline around the download and execution, including email or chat lures, browser activity, support interactions, and whether IT authorized the installation.
- Examine installer logs and subsequent host changes for new services, scheduled tasks, startup entries, RMM configuration or tenant identifiers, unattended-access settings, and suspicious child processes.
- Review post-install network connections and RMM session activity for remote commands, file transfers, credential access, or additional payloads, then scope matching hashes, domains, and agent identifiers across the environment and isolate unauthorized systems.

### False positive analysis

- Authorized IT staff may install an approved RMM agent from its official internet distribution site, so confirm the source domain, MSI signature and hash, target host, and associated change record.
- A user may install an RMM package during a legitimate support session, so verify the support request, user confirmation, expected executable, and whether unattended access was authorized.

### Response and remediation

- Isolate affected systems from the network, terminate active RMM sessions and processes, and block the MSI hash, source domain, download URL, and identified RMM infrastructure.
- Uninstall the unauthorized RMM agent and remove its services, scheduled tasks, startup entries, unattended-access configuration, dropped executables, installer cache, and downloaded MSI.
- Escalate immediately to incident response if the RMM agent established a remote session, executed commands, transferred files, accessed credentials, installed additional payloads, or appears on multiple systems.
- Reset credentials and revoke active sessions for affected users and privileged accounts used on the host, then review adjacent systems for reuse of the MSI hash, RMM executable, tenant identifier, or source domain.
- Reimage systems from a known-good baseline when integrity cannot be established, restore validated data, patch the operating system and applications, and verify that no unauthorized RMM connectivity or persistence remains.
- Prevent recurrence by allowlisting approved RMM products and tenant identifiers, restricting MSI execution and software installation to managed deployment channels, applying application control, and blocking unapproved remote-access tools and download sources.
"""
references = [
    "https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice",
    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a",
    "https://cloud.google.com/blog/topics/threat-intelligence/seo-poisoning-batloader-atera/",
    "https://www.microsoft.com/en-us/security/blog/2026/03/03/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/",
    "https://www.huntress.com/blog/series-of-unfortunate-rmm-events",
]
risk_score = 21
rule_id = "7dd15e54-0e23-4e99-80e7-6651ef7ce9d5"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Platform: Windows",
    "Rule Type: ES|QL",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
/*
Correlate three events on the same host: an internet-originated MSI outside the curated web-service set, the same user
running that MSI with msiexec within 10 minutes, and msiexec creating a known RMM executable within 5 more minutes.
Keep the MSI download event as the alert.
*/
FROM
(
  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
    | WHERE KQL("event.action: creation") AND TO_LOWER(file.extension) == "msi" AND file.origin_url IS NOT NULL
    | EVAL Esql.sequence_stage = "origin"
    | URI_PARTS Esql.origin = file.origin_url
    | EVAL Esql.origin.domain = TO_LOWER(Esql.origin.domain)
    // Complement the curated tier.
    | WHERE NOT (
      // Source code and developer artifact hosting.
      Esql.origin.domain LIKE (
        "api.bitbucket.org", "bitbucket.org",
        "api.github.com", "gist.githubusercontent.com", "github.com",
        "github-releases.githubusercontent.com", "objects.githubusercontent.com",
        "raw.githack.com", "raw.githubusercontent.com", "rawcdn.githack.com",
        "release-assets.githubusercontent.com",
        "gitlab.com", "*.gitlab.com",
        "notabug.org",
        "sourceforge.net", "*.sourceforge.net"
      ) OR
      // AWS S3 object storage.
      Esql.origin.domain LIKE (
        "s3.amazonaws.com", "*.s3.amazonaws.com",
        "s3.*.amazonaws.com", "*.s3.*.amazonaws.com",
        "s3-*.amazonaws.com", "*.s3-*.amazonaws.com",
        "*.s3express-*.amazonaws.com"
      ) OR
      // Azure, Cloudflare R2, Discord, and Dropbox.
      Esql.origin.domain LIKE (
        "*.azurewebsites.net", "*.azurestaticapps.net",
        "*.azurecontainerapps.io",
        "*.blob.core.windows.net", "*.blob.storage.azure.net",
        "*.web.core.windows.net", "*.web.storage.azure.net",
        "*.file.core.windows.net",
        "*.azurefd.net", "*.azureedge.net",
        "*.r2.dev",
        "cdn.discordapp.com",
        "dropbox.com", "*.dropbox.com",
        "dropboxusercontent.com", "*.dropboxusercontent.com"
      ) OR
      // Firebase Storage, Google Drive, and Cloud Storage.
      Esql.origin.domain LIKE (
        "*.googleusercontent.com", "content-storage.googleapis.com",
        "firebasestorage.googleapis.com",
        "docs.google.com", "drive.google.com", "drive.usercontent.google.com",
        "storage-download.googleapis.com", "storage.googleapis.com", "*.storage.googleapis.com",
        "www.googleapis.com"
      ) OR
      // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
      Esql.origin.domain LIKE (
        "api.onedrive.com", "files.1drv.com", "*.files.1drv.com",
        "onedrive.live.com", "*.onedrive.live.com",
        "sharepoint.com", "*.sharepoint.com",
        "storage.live.com", "*.storage.live.com",
        "onehub.com", "*.onehub.com",
        "onlyoffice.com", "*.onlyoffice.com",
        "pcloud.com", "*.pcloud.com",
        "files.slack.com", "slack-files.com",
        "*.supabase.co",
        "s3.wasabisys.com", "*.s3.wasabisys.com",
        "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
      ) OR
      // Developer tunnels, reverse proxies, automation, and webhooks.
      Esql.origin.domain LIKE (
        "devtunnels.ms", "*.devtunnels.ms",
        "localtunnel.me", "*.localtunnel.me",
        "n8n.cloud", "*.n8n.cloud",
        "*.ngrok.app", "*.ngrok.dev",
        "*.ngrok-free.app", "*.ngrok-free.dev",
        "*.ngrok.io", "*.ngrok.pizza", "*.ngrok.pro",
        "pagekite.me", "*.pagekite.me",
        "serveo.net", "*.serveo.net",
        "trycloudflare.com", "*.trycloudflare.com",
        "webhook.site"
      ) OR
      // File-sharing and transfer services.
      Esql.origin.domain LIKE (
        "4shared.com", "*.4shared.com",
        "*.4sync.com",
        "bashupload.com", "*.bashupload.com",
        "catbox.moe", "*.catbox.moe",
        "easyupload.io", "*.easyupload.io",
        "file.io",
        "filebin.net",
        "filecloud.me",
        "files.fm", "*.files.fm",
        "filetransfer.io", "*.filetransfer.io",
        "gofile.io", "*.gofile.io",
        "limewire.com", "*.limewire.com",
        "mediafire.com", "*.mediafire.com",
        "mega.co.nz", "*.mega.co.nz",
        "mega.nz", "*.mega.nz",
        "pixeldrain.com", "*.pixeldrain.com",
        "send.cm", "*.send.cm", "send.now", "*.send.now",
        "sendit.sh", "*.sendit.sh",
        "sendspace.com", "*.sendspace.com",
        "share.riseup.net",
        "temp.sh", "tempsend.com",
        "transfer.sh",
        "ufile.io", "*.ufile.io",
        "upload.ee", "*.upload.ee",
        "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net",
        "workupload.com"
      ) OR
      // CDN, paste, and public hosting services.
      Esql.origin.domain LIKE (
        "*.alwaysdata.net",
        "blogspot.com", "*.blogspot.com",
        "b-cdn.net", "*.b-cdn.net",
        "cdnmegafiles.com", "*.cdnmegafiles.com",
        "infinityfreeapp.com", "*.infinityfreeapp.com",
        "free.keep.sh",
        "*.netlify.app",
        "paste.ee",
        "publicvm.com", "*.publicvm.com",
        "*.vercel.app",
        "*.*.workers.dev"
      ) OR
      // Decentralized and content-addressed storage.
      Esql.origin.domain LIKE (
        "ar.io", "*.ar.io", "arweave.net", "*.arweave.net",
        "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io",
        "dweb.link", "*.dweb.link",
        "gateway.pinata.cloud",
        "ipfs.io", "*.ipfs.io",
        "mypinata.cloud", "*.mypinata.cloud",
        "nftstorage.link", "*.nftstorage.link",
        "storjshare.io", "*.storjshare.io",
        "web3.storage", "*.web3.storage"
      )
    )
),
(
  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
  | WHERE host.os.type == "windows" AND
      KQL("event.type: start") AND
      process.name.caseless == "msiexec.exe"
  | EVAL Esql.sequence_stage = "execute"
  | KEEP @timestamp, host.id, process.args, user.id, _id, _version, _index, Esql.sequence_stage
),
(
  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
  | WHERE KQL("event.action: creation") AND process.name.caseless == "msiexec.exe"
  | EVAL file.name.caseless = TO_LOWER(file.name)
  | WHERE
    file.name.caseless IN (
      // Acronis
      "acroniscyberprotectconnectagent.exe",

      // AeroAdmin
      "aeroadmin.exe",

      // AnyDesk
      "anydesk.exe",

      // APC
      "apc_admin.exe",
      "apc_host.exe",

      // Atera
      "ateraagent.exe",

      // AweSun
      "awesun.exe",

      // BarracudaRMM
      "cagservice.exe",

      // BeyondTrust
      "b4-service.exe",
      "basupsrvc.exe",
      "bomgar-scc.exe",
      "remote support.exe",

      // CloudRadial
      "cloudracmd.exe",
      "cloudrasd.exe",
      "cloudraservice.exe",

      // ConnectWiseAutomate
      "agentmon.exe",
      "ltsvc.exe",
      "ltsvcmon.exe",
      "lttray.exe",

      // Devolutions
      "remotedesktopmanager.exe",

      // Domotz
      "domotz-windows-x64-10.exe",
      "domotzagent.exe",

      // DWService
      "dwagsvc.exe",
      "dwrcc.exe",
      "dwrcs.exe",
      "dwrcst.exe",

      // GetScreen
      "getscreen.exe",

      // GoTo
      "g2aservice.exe",
      "gotoassistservice.exe",
      "gotohttp.exe",
      "gotoresolveprocesschecker.exe",
      "gotoresolveremotecontrol.exe",
      "gotoresolveservice.exe",
      "gotoresolveterminal.exe",
      "gotoresolveunattended.exe",

      // HelpWire
      "helpwire.exe",

      // ImmyBot
      "immyagent.exe",
      "immybot.agent.ephemeral.exe",
      "immyupdater.exe",

      // Impero
      "imperoclientsvc.exe",
      "imperoserversvc.exe",

      // ISLOnline
      "isllight.exe",
      "isllightclient.exe",

      // JumpCloud
      "jumpcloud-agent.exe",

      // Kaseya
      "saazapsc.exe",

      // Komari
      "komari-agent.exe",
      "komari.exe",

      // Level
      "level.exe",
      "lvagent.exe",

      // LogMeIn
      "lmi_rescue_srv.exe",
      "lmi_rescue.exe",
      "lmiignition.exe",
      "logmein.exe",

      // Lunixar
      "lunixar.exe",
      "lunixarremote.exe",
      "lunixarupdater.exe",

      // ManageEngine
      "manageengine_remote_access_plus.exe",

      // MeshCentral
      "meshagent.exe",

      // Mikogo
      "mikogo-service.exe",

      // Nezha
      "nezha-agent.exe",

      // NinjaOne
      "ninjarmm-cli.exe",
      "ninjarmmagent.exe",
      "ninjarmmagentpatcher.exe",

      // Parsec
      "parsec.exe",

      // PDQ Connect
      "pdq-connect-agent.exe",
      "pdq-connect-updater.exe",

      // Pulseway
      "pservice.exe",

      // QuickAssist
      "quickassist.exe",

      // Radmin
      "r_server.exe",
      "radmin.exe",
      "radmin3.exe",
      "rserver3.exe",

      // RealVNC
      "romserver.exe",
      "romviewer.exe",
      "vncserver.exe",
      "vncviewer.exe",
      "winvnc.exe",

      // Remotely
      "remotely_agent.exe",
      "remotely_desktop.exe",

      // RemotePC
      "remotepc.exe",
      "remotepcdesktop.exe",
      "remotepcservice.exe",

      // RemoteUtilities
      "rfusclient.exe",
      "rutserv.exe",
      "rutview.exe",

      // RPCSuite
      "rcclient.exe",
      "rcservice.exe",
      "rpcsuite.exe",

      // Rsupport
      "rcengmgru.exe",
      "rcmgrsvc.exe",
      "remoteview.exe",
      "rvagent.exe",
      "rvagtray.exe",

      // RustDesk
      "rustdesk.exe",

      // SimpleHelp
      "simplegatewayservice.exe",
      "simplehelpcustomer.exe",

      // Splashtop
      "smpcview.exe",
      "spclink.exe",
      "splashtop-streamer.exe",
      "splashtopsos.exe",
      "spsrv.exe",
      "sragent.exe",
      "srmanager.exe",
      "srserver.exe",
      "srservice.exe",
      "strwinclt.exe",

      // SuperOps
      "rmm.agent.exe",

      // Supremo
      "supremo.exe",
      "supremoservice.exe",

      // Syncro
      "syncro.app.runner.exe",
      "syncro.installer.exe",
      "syncro.overmind.service.exe",
      "syncro.service.exe",
      "syncrolive.agent.exe",
      "syncrolive.agent.runner.exe",
      "syncrolive.service.exe",

      // TacticalRMM
      "tacticalrmm.exe",

      // Tailscale
      "tailscale.exe",
      "tailscaled.exe",

      // TeamViewer
      "teamviewer_desktop.exe",
      "teamviewer_service.exe",
      "teamviewer.exe",

      // Techinline
      "tsclient.exe",

      // Tiflux
      "tiagent.exe",
      "ticlientcore.exe",

      // TightVNC
      "tvn.exe",
      "tvnserver.exe",
      "tvnviewer.exe",

      // ToDesk
      "todesk_service.exe",

      // ToolsIQ
      "toolsiq.exe",

      // Twingate
      "twingate.exe",

      // Velociraptor
      "velociraptor.exe",

      // ZohoAssist
      "session_win.exe",
      "za_access.exe",
      "za_connect.exe",
      "zaservice.exe",
      "zmagent.exe",
      "zohomeeting.exe",
      "zohotray.exe",
      "zohours.exe",
      "zohoursservice.exe"
    ) OR
    file.name.caseless LIKE (
      // AnyAssist
      "aa_v*.exe",

      // AweSun
      "aweray_remote*.exe",

      // FleetDeck
      "fleetdeck_commander*.exe",

      // ScreenConnect
      "connectwisecontrol*.exe",
      "screenconnect*.exe",

      // UltraViewer
      "ultraviewer*.exe",

      // UltraVNC
      "ultravnc*.exe"
    )
  // Keep the executable name paired with its creation time through the host-level aggregation.
  | EVAL
      Esql.sequence_stage = "install",
      Esql.install_candidate = CONCAT(TO_STRING(@timestamp), "|", file.name)
  | KEEP @timestamp, host.id, _id, _version, _index, Esql.sequence_stage, Esql.install_candidate
)

| WHERE host.id IS NOT NULL

// Attach known RMM executable creation candidates to all rows on the same host.
// Retain only download and execution candidates from hosts with at least one such creation.
| INLINE STATS
    Esql.install_count = COUNT(*) WHERE Esql.sequence_stage == "install",
    Esql.install_candidates = VALUES(Esql.install_candidate) WHERE Esql.sequence_stage == "install"
  BY host.id
| DROP Esql.install_candidate
| WHERE Esql.sequence_stage IN ("origin", "execute") AND Esql.install_count > 0

// Lowercase the downloaded path and every msiexec argument, remove the :Zone.Identifier marker,
// and keep values ending in .msi as the shared path key.
| EVAL
    Esql.candidate_path = CASE(
      Esql.sequence_stage == "origin", file.path,
      process.args
    ),
    Esql.actor_user_id = user.id
| MV_EXPAND Esql.candidate_path
| EVAL Esql.artifact_path =
    REPLACE(TO_LOWER(Esql.candidate_path), ":zone.identifier", "")
| WHERE Esql.artifact_path LIKE "*.msi" AND Esql.actor_user_id IS NOT NULL

// Match the origin event and msiexec start using host, MSI path, and user SID.
| INLINE STATS
    Esql.execute_count = COUNT(*) WHERE Esql.sequence_stage == "execute",
    Esql.execute_times = VALUES(@timestamp) WHERE Esql.sequence_stage == "execute"
  BY host.id, Esql.artifact_path, Esql.actor_user_id
| WHERE
    // Keep the real origin event as the alert document.
    Esql.sequence_stage == "origin" AND
    Esql.execute_count > 0

// Require the matching msiexec process to start within 10 minutes after the MSI download.
| MV_EXPAND Esql.execute_times
| EVAL Esql.origin_to_execute_s =
    DATE_DIFF("second", @timestamp, Esql.execute_times)
| WHERE
    Esql.origin_to_execute_s >= 0 AND
    Esql.origin_to_execute_s <= 600

// On the same host, require any msiexec process to create a known RMM executable
// within 5 minutes after the matched start.
| MV_EXPAND Esql.install_candidates
| EVAL
    Esql.install_time = TO_DATETIME(MV_FIRST(SPLIT(Esql.install_candidates, "|"))),
    Esql.rmm_file_name = MV_LAST(SPLIT(Esql.install_candidates, "|")),
    Esql.execute_to_install_s = DATE_DIFF("second", Esql.execute_times, Esql.install_time)
| DROP Esql.install_candidates
| WHERE
    Esql.execute_to_install_s >= 0 AND
    Esql.execute_to_install_s <= 300

// Select one concrete origin row per host, MSI path, and user, preferring the
// earliest RMM executable creation when second-level durations tie.
| SORT
    Esql.execute_times ASC,
    Esql.origin_to_execute_s ASC,
    Esql.execute_to_install_s ASC,
    Esql.install_time ASC,
    Esql.rmm_file_name ASC,
    _id ASC
| LIMIT 1 BY host.id, Esql.artifact_path, Esql.actor_user_id

| RENAME Esql.execute_times AS Esql.execute_time
| KEEP
    @timestamp, _id, _index, _version,
    event.action, event.category, event.type, event.created, event.ingested,
    data_stream.dataset, data_stream.namespace,
    host.id, host.name,
    user.id, user.name,
    process.entity_id, process.name, process.executable, process.command_line,
    file.name, file.path, file.extension, file.origin_url, file.origin_referrer_url,
    file.size, file.hash.sha256,
    Esql.origin.domain, Esql.artifact_path, Esql.execute_time,
    Esql.install_time, Esql.rmm_file_name,
    Esql.origin_to_execute_s, Esql.execute_to_install_s
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"
[[rule.threat.technique.subtechnique]]
id = "T1219.002"
name = "Remote Desktop Software"
reference = "https://attack.mitre.org/techniques/T1219/002/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"