RMM Software Installation from a Commonly Abused Web Service

[metadata]
creation_date = "2026/08/07"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "FROM subquery support became generally available in 9.5.0"
min_stack_version = "9.5.0"
updated_date = "2026/09/18"

[rule]
author = ["Elastic"]
description = """
Identifies Windows Installer (MSI) packages that originate from commonly abused web services and install a recognized
remote monitoring and management (RMM) product. Adversaries may abuse legitimate RMM software in social engineering
campaigns to gain remote access and control over victim systems. This rule does not establish that the origin,
installer, or RMM product is inherently malicious. Origins outside this set are covered by the companion rule "RMM
Software Installation from an Internet-Originated MSI".
"""
false_positives = [
    """
    Authorized IT or managed service provider deployment of remote monitoring and management software through public,
    vendor, or software distribution infrastructure can produce this behavior.
    """,
]
from = "now-25m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "RMM Software Installation from a Commonly Abused Web Service"
note = """ ## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating RMM Software Installation from a Commonly Abused Web Service

This rule detects a Windows MSI downloaded from a commonly abused hosting service, executed shortly afterward, and followed by installation of a recognized remote management tool, a sequence that can establish covert remote access. An attacker may send a phishing link to a file-sharing site, persuade the user to run the downloaded installer, and deploy an unattended remote-control agent for persistent system access.

### Possible investigation steps

- Validate the MSI’s digital signature, publisher, SHA-256 reputation, download URL, and referrer to distinguish an official vendor package from a repackaged or impersonated installer.
- Review the user’s browser, email, chat, and recent authentication activity to determine how the download was initiated and whether the RMM installation was authorized by IT.
- Reconstruct the execution chain around the installer, including its parent process, command-line options, privilege elevation, and any scripts or utilities launched immediately before or after installation.
- Examine the installed RMM product’s services, scheduled tasks, registry entries, configuration files, enrollment identifiers, and outbound connections for unattended access or linkage to an unknown tenant.
- Hunt across the environment for the same MSI hash, source URL, RMM executable, publisher, destination infrastructure, or enrollment details, and isolate affected hosts if the deployment is unauthorized.

### False positive analysis

- An authorized administrator may install an approved RMM package hosted on a listed source-code, cloud-storage, or file-sharing domain; confirm the user, host, MSI signature and hash, source URL, and deployment timing against an approved change record.
- A user may install an approved remote-support client from a legitimate shared download link during a scheduled support session; verify the session with the user or support team and confirm the installed agent is enrolled in the organization’s expected tenant.

### Response and remediation

- Isolate affected Windows hosts from the network while preserving management access, and block the malicious MSI hash, download URL, and identified RMM destination infrastructure.
- Terminate active RMM sessions and processes, uninstall the unauthorized agent, remove its services, scheduled tasks, startup registry entries, configuration files, enrollment identifiers, and downloaded MSI, and verify that none are recreated.
- Disable or reset the affected user and RMM-associated accounts, revoke active sessions and tokens, rotate exposed privileged credentials, and review remote logons for unauthorized access.
- Escalate immediately to incident response if the RMM agent ran with administrative privileges, appears on multiple hosts, used an unknown tenant, enabled lateral movement, or accessed sensitive systems or data.
- Reimage hosts from a trusted baseline when system integrity cannot be established, restore only validated data, patch the system, and confirm the unauthorized RMM executable and persistence mechanisms are absent before reconnecting it.
- Prevent recurrence by allowlisting approved RMM products and tenants, restricting MSI execution and unapproved remote-access tools, filtering known malicious hosting URLs, and requiring documented authorization for remote-support installations.
"""
references = [
    "https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice",
    "https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/",
    "https://www.forcepoint.com/blog/x-labs/screenconnect-attack",
    "https://www.levelblue.com/blogs/spiderlabs-blog/beyond-fake-updates-from-application-store-themed-phishing-to-large-scale-distribution-of-screenconnect",
    "https://www.security.com/threat-intelligence/rmm-logmein-attacks",
    "https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill",
    "https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399",
    "https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm",
    "https://www.fortian.com.au/blog/trusted-domains-disposable-infrastructure-tax-season-phishing-on-vercel.html",
    "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution",
]
risk_score = 47
rule_id = "ed626330-f3ac-4568-b4e4-cbc296748320"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""
severity = "medium"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Platform: Windows",
    "Rule Type: ES|QL",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
/*
Correlate three events on the same host: an MSI downloaded from a commonly abused web service, the same user running
that MSI with msiexec within 10 minutes, and msiexec creating a known RMM executable within 5 more minutes. Keep the
MSI download event as the alert.
*/
FROM
(
  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
    | WHERE KQL("event.action: creation") AND TO_LOWER(file.extension) == "msi" AND file.origin_url IS NOT NULL
    | EVAL Esql.sequence_stage = "origin"
    | URI_PARTS Esql.origin = file.origin_url
    | EVAL Esql.origin.domain = TO_LOWER(Esql.origin.domain)
    | WHERE (
      // Source code and developer artifact hosting.
      Esql.origin.domain LIKE (
        "api.bitbucket.org", "bitbucket.org",
        "api.github.com", "gist.githubusercontent.com", "github.com",
        "github-releases.githubusercontent.com", "objects.githubusercontent.com",
        "raw.githack.com", "raw.githubusercontent.com", "rawcdn.githack.com",
        "release-assets.githubusercontent.com",
        "gitlab.com", "*.gitlab.com",
        "notabug.org",
        "sourceforge.net", "*.sourceforge.net"
      ) OR
      // AWS S3 object storage.
      Esql.origin.domain LIKE (
        "s3.amazonaws.com", "*.s3.amazonaws.com",
        "s3.*.amazonaws.com", "*.s3.*.amazonaws.com",
        "s3-*.amazonaws.com", "*.s3-*.amazonaws.com",
        "*.s3express-*.amazonaws.com"
      ) OR
      // Azure, Cloudflare R2, Discord, and Dropbox.
      Esql.origin.domain LIKE (
        "*.azurewebsites.net", "*.azurestaticapps.net",
        "*.azurecontainerapps.io",
        "*.blob.core.windows.net", "*.blob.storage.azure.net",
        "*.web.core.windows.net", "*.web.storage.azure.net",
        "*.file.core.windows.net",
        "*.azurefd.net", "*.azureedge.net",
        "*.r2.dev",
        "cdn.discordapp.com",
        "dropbox.com", "*.dropbox.com",
        "dropboxusercontent.com", "*.dropboxusercontent.com"
      ) OR
      // Firebase Storage, Google Drive, and Cloud Storage.
      Esql.origin.domain LIKE (
        "*.googleusercontent.com", "content-storage.googleapis.com",
        "firebasestorage.googleapis.com",
        "docs.google.com", "drive.google.com", "drive.usercontent.google.com",
        "storage-download.googleapis.com", "storage.googleapis.com", "*.storage.googleapis.com",
        "www.googleapis.com"
      ) OR
      // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
      Esql.origin.domain LIKE (
        "api.onedrive.com", "files.1drv.com", "*.files.1drv.com",
        "onedrive.live.com", "*.onedrive.live.com",
        "sharepoint.com", "*.sharepoint.com",
        "storage.live.com", "*.storage.live.com",
        "onehub.com", "*.onehub.com",
        "onlyoffice.com", "*.onlyoffice.com",
        "pcloud.com", "*.pcloud.com",
        "files.slack.com", "slack-files.com",
        "*.supabase.co",
        "s3.wasabisys.com", "*.s3.wasabisys.com",
        "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
      ) OR
      // Developer tunnels, reverse proxies, automation, and webhooks.
      Esql.origin.domain LIKE (
        "devtunnels.ms", "*.devtunnels.ms",
        "localtunnel.me", "*.localtunnel.me",
        "n8n.cloud", "*.n8n.cloud",
        "*.ngrok.app", "*.ngrok.dev",
        "*.ngrok-free.app", "*.ngrok-free.dev",
        "*.ngrok.io", "*.ngrok.pizza", "*.ngrok.pro",
        "pagekite.me", "*.pagekite.me",
        "serveo.net", "*.serveo.net",
        "trycloudflare.com", "*.trycloudflare.com",
        "webhook.site"
      ) OR
      // File-sharing and transfer services.
      Esql.origin.domain LIKE (
        "4shared.com", "*.4shared.com",
        "*.4sync.com",
        "bashupload.com", "*.bashupload.com",
        "catbox.moe", "*.catbox.moe",
        "easyupload.io", "*.easyupload.io",
        "file.io",
        "filebin.net",
        "filecloud.me",
        "files.fm", "*.files.fm",
        "filetransfer.io", "*.filetransfer.io",
        "gofile.io", "*.gofile.io",
        "limewire.com", "*.limewire.com",
        "mediafire.com", "*.mediafire.com",
        "mega.co.nz", "*.mega.co.nz",
        "mega.nz", "*.mega.nz",
        "pixeldrain.com", "*.pixeldrain.com",
        "send.cm", "*.send.cm", "send.now", "*.send.now",
        "sendit.sh", "*.sendit.sh",
        "sendspace.com", "*.sendspace.com",
        "share.riseup.net",
        "temp.sh", "tempsend.com",
        "transfer.sh",
        "ufile.io", "*.ufile.io",
        "upload.ee", "*.upload.ee",
        "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net",
        "workupload.com"
      ) OR
      // CDN, paste, and public hosting services.
      Esql.origin.domain LIKE (
        "*.alwaysdata.net",
        "blogspot.com", "*.blogspot.com",
        "b-cdn.net", "*.b-cdn.net",
        "cdnmegafiles.com", "*.cdnmegafiles.com",
        "infinityfreeapp.com", "*.infinityfreeapp.com",
        "free.keep.sh",
        "*.netlify.app",
        "paste.ee",
        "publicvm.com", "*.publicvm.com",
        "*.vercel.app",
        "*.*.workers.dev"
      ) OR
      // Decentralized and content-addressed storage.
      Esql.origin.domain LIKE (
        "ar.io", "*.ar.io", "arweave.net", "*.arweave.net",
        "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io",
        "dweb.link", "*.dweb.link",
        "gateway.pinata.cloud",
        "ipfs.io", "*.ipfs.io",
        "mypinata.cloud", "*.mypinata.cloud",
        "nftstorage.link", "*.nftstorage.link",
        "storjshare.io", "*.storjshare.io",
        "web3.storage", "*.web3.storage"
      )
    )
),
(
  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
  | WHERE host.os.type == "windows" AND
      KQL("event.type: start") AND
      process.name.caseless == "msiexec.exe"
  | EVAL Esql.sequence_stage = "execute"
  | KEEP @timestamp, host.id, process.args, user.id, _id, _version, _index, Esql.sequence_stage
),
(
  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
  | WHERE KQL("event.action: creation") AND process.name.caseless == "msiexec.exe"
  | EVAL file.name.caseless = TO_LOWER(file.name)
  | WHERE
    file.name.caseless IN (
      // Acronis
      "acroniscyberprotectconnectagent.exe",

      // AeroAdmin
      "aeroadmin.exe",

      // AnyDesk
      "anydesk.exe",

      // APC
      "apc_admin.exe",
      "apc_host.exe",

      // Atera
      "ateraagent.exe",

      // AweSun
      "awesun.exe",

      // BarracudaRMM
      "cagservice.exe",

      // BeyondTrust
      "b4-service.exe",
      "basupsrvc.exe",
      "bomgar-scc.exe",
      "remote support.exe",

      // CloudRadial
      "cloudracmd.exe",
      "cloudrasd.exe",
      "cloudraservice.exe",

      // ConnectWiseAutomate
      "agentmon.exe",
      "ltsvc.exe",
      "ltsvcmon.exe",
      "lttray.exe",

      // Devolutions
      "remotedesktopmanager.exe",

      // Domotz
      "domotz-windows-x64-10.exe",
      "domotzagent.exe",

      // DWService
      "dwagsvc.exe",
      "dwrcc.exe",
      "dwrcs.exe",
      "dwrcst.exe",

      // GetScreen
      "getscreen.exe",

      // GoTo
      "g2aservice.exe",
      "gotoassistservice.exe",
      "gotohttp.exe",
      "gotoresolveprocesschecker.exe",
      "gotoresolveremotecontrol.exe",
      "gotoresolveservice.exe",
      "gotoresolveterminal.exe",
      "gotoresolveunattended.exe",

      // HelpWire
      "helpwire.exe",

      // ImmyBot
      "immyagent.exe",
      "immybot.agent.ephemeral.exe",
      "immyupdater.exe",

      // Impero
      "imperoclientsvc.exe",
      "imperoserversvc.exe",

      // ISLOnline
      "isllight.exe",
      "isllightclient.exe",

      // JumpCloud
      "jumpcloud-agent.exe",

      // Kaseya
      "saazapsc.exe",

      // Komari
      "komari-agent.exe",
      "komari.exe",

      // Level
      "level.exe",
      "lvagent.exe",

      // LogMeIn
      "lmi_rescue_srv.exe",
      "lmi_rescue.exe",
      "lmiignition.exe",
      "logmein.exe",

      // Lunixar
      "lunixar.exe",
      "lunixarremote.exe",
      "lunixarupdater.exe",

      // ManageEngine
      "manageengine_remote_access_plus.exe",

      // MeshCentral
      "meshagent.exe",

      // Mikogo
      "mikogo-service.exe",

      // Nezha
      "nezha-agent.exe",

      // NinjaOne
      "ninjarmm-cli.exe",
      "ninjarmmagent.exe",
      "ninjarmmagentpatcher.exe",

      // Parsec
      "parsec.exe",

      // PDQ Connect
      "pdq-connect-agent.exe",
      "pdq-connect-updater.exe",

      // Pulseway
      "pservice.exe",

      // QuickAssist
      "quickassist.exe",

      // Radmin
      "r_server.exe",
      "radmin.exe",
      "radmin3.exe",
      "rserver3.exe",

      // RealVNC
      "romserver.exe",
      "romviewer.exe",
      "vncserver.exe",
      "vncviewer.exe",
      "winvnc.exe",

      // Remotely
      "remotely_agent.exe",
      "remotely_desktop.exe",

      // RemotePC
      "remotepc.exe",
      "remotepcdesktop.exe",
      "remotepcservice.exe",

      // RemoteUtilities
      "rfusclient.exe",
      "rutserv.exe",
      "rutview.exe",

      // RPCSuite
      "rcclient.exe",
      "rcservice.exe",
      "rpcsuite.exe",

      // Rsupport
      "rcengmgru.exe",
      "rcmgrsvc.exe",
      "remoteview.exe",
      "rvagent.exe",
      "rvagtray.exe",

      // RustDesk
      "rustdesk.exe",

      // SimpleHelp
      "simplegatewayservice.exe",
      "simplehelpcustomer.exe",

      // Splashtop
      "smpcview.exe",
      "spclink.exe",
      "splashtop-streamer.exe",
      "splashtopsos.exe",
      "spsrv.exe",
      "sragent.exe",
      "srmanager.exe",
      "srserver.exe",
      "srservice.exe",
      "strwinclt.exe",

      // SuperOps
      "rmm.agent.exe",

      // Supremo
      "supremo.exe",
      "supremoservice.exe",

      // Syncro
      "syncro.app.runner.exe",
      "syncro.installer.exe",
      "syncro.overmind.service.exe",
      "syncro.service.exe",
      "syncrolive.agent.exe",
      "syncrolive.agent.runner.exe",
      "syncrolive.service.exe",

      // TacticalRMM
      "tacticalrmm.exe",

      // Tailscale
      "tailscale.exe",
      "tailscaled.exe",

      // TeamViewer
      "teamviewer_desktop.exe",
      "teamviewer_service.exe",
      "teamviewer.exe",

      // Techinline
      "tsclient.exe",

      // Tiflux
      "tiagent.exe",
      "ticlientcore.exe",

      // TightVNC
      "tvn.exe",
      "tvnserver.exe",
      "tvnviewer.exe",

      // ToDesk
      "todesk_service.exe",

      // ToolsIQ
      "toolsiq.exe",

      // Twingate
      "twingate.exe",

      // Velociraptor
      "velociraptor.exe",

      // ZohoAssist
      "session_win.exe",
      "za_access.exe",
      "za_connect.exe",
      "zaservice.exe",
      "zmagent.exe",
      "zohomeeting.exe",
      "zohotray.exe",
      "zohours.exe",
      "zohoursservice.exe"
    ) OR
    file.name.caseless LIKE (
      // AnyAssist
      "aa_v*.exe",

      // AweSun
      "aweray_remote*.exe",

      // FleetDeck
      "fleetdeck_commander*.exe",

      // ScreenConnect
      "connectwisecontrol*.exe",
      "screenconnect*.exe",

      // UltraViewer
      "ultraviewer*.exe",

      // UltraVNC
      "ultravnc*.exe"
    )
  // Keep the executable name paired with its creation time through the host-level aggregation.
  | EVAL
      Esql.sequence_stage = "install",
      Esql.install_candidate = CONCAT(TO_STRING(@timestamp), "|", file.name)
  | KEEP @timestamp, host.id, _id, _version, _index, Esql.sequence_stage, Esql.install_candidate
)

| WHERE host.id IS NOT NULL

// Attach known RMM executable creation candidates to all rows on the same host.
// Retain only download and execution candidates from hosts with at least one such creation.
| INLINE STATS
    Esql.install_count = COUNT(*) WHERE Esql.sequence_stage == "install",
    Esql.install_candidates = VALUES(Esql.install_candidate) WHERE Esql.sequence_stage == "install"
  BY host.id
| DROP Esql.install_candidate
| WHERE Esql.sequence_stage IN ("origin", "execute") AND Esql.install_count > 0

// Lowercase the downloaded path and every msiexec argument, remove the :Zone.Identifier marker,
// and keep values ending in .msi as the shared path key.
| EVAL
    Esql.candidate_path = CASE(
      Esql.sequence_stage == "origin", file.path,
      process.args
    ),
    Esql.actor_user_id = user.id
| MV_EXPAND Esql.candidate_path
| EVAL Esql.artifact_path =
    REPLACE(TO_LOWER(Esql.candidate_path), ":zone.identifier", "")
| WHERE Esql.artifact_path LIKE "*.msi" AND Esql.actor_user_id IS NOT NULL

// Match the origin event and msiexec start using host, MSI path, and user SID.
| INLINE STATS
    Esql.execute_count = COUNT(*) WHERE Esql.sequence_stage == "execute",
    Esql.execute_times = VALUES(@timestamp) WHERE Esql.sequence_stage == "execute"
  BY host.id, Esql.artifact_path, Esql.actor_user_id
| WHERE
    // Keep the real origin event as the alert document.
    Esql.sequence_stage == "origin" AND
    Esql.execute_count > 0

// Require the matching msiexec process to start within 10 minutes after the MSI download.
| MV_EXPAND Esql.execute_times
| EVAL Esql.origin_to_execute_s =
    DATE_DIFF("second", @timestamp, Esql.execute_times)
| WHERE
    Esql.origin_to_execute_s >= 0 AND
    Esql.origin_to_execute_s <= 600

// On the same host, require any msiexec process to create a known RMM executable
// within 5 minutes after the matched start.
| MV_EXPAND Esql.install_candidates
| EVAL
    Esql.install_time = TO_DATETIME(MV_FIRST(SPLIT(Esql.install_candidates, "|"))),
    Esql.rmm_file_name = MV_LAST(SPLIT(Esql.install_candidates, "|")),
    Esql.execute_to_install_s = DATE_DIFF("second", Esql.execute_times, Esql.install_time)
| DROP Esql.install_candidates
| WHERE
    Esql.execute_to_install_s >= 0 AND
    Esql.execute_to_install_s <= 300

// Select one concrete origin row per host, MSI path, and user, preferring the
// earliest RMM executable creation when second-level durations tie.
| SORT
    Esql.execute_times ASC,
    Esql.origin_to_execute_s ASC,
    Esql.execute_to_install_s ASC,
    Esql.install_time ASC,
    Esql.rmm_file_name ASC,
    _id ASC
| LIMIT 1 BY host.id, Esql.artifact_path, Esql.actor_user_id

| RENAME Esql.execute_times AS Esql.execute_time
| KEEP
    @timestamp, _id, _index, _version,
    event.action, event.category, event.type, event.created, event.ingested,
    data_stream.dataset, data_stream.namespace,
    host.id, host.name,
    user.id, user.name,
    process.entity_id, process.name, process.executable, process.command_line,
    file.name, file.path, file.extension, file.origin_url, file.origin_referrer_url,
    file.size, file.hash.sha256,
    Esql.origin.domain, Esql.artifact_path, Esql.execute_time,
    Esql.install_time, Esql.rmm_file_name,
    Esql.origin_to_execute_s, Esql.execute_to_install_s
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[[rule.threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"
[[rule.threat.technique.subtechnique]]
id = "T1219.002"
name = "Remote Desktop Software"
reference = "https://attack.mitre.org/techniques/T1219/002/"



[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"