RMM abuse and first-seen detections: are your controls keeping up?

TL;DR: Remote monitoring and management abuse remains a high-volume intrusion path, according to Abstract Security’s ASTRO, with Huntress reporting a 277% increase in RMM abuse and Arctic Wolf finding RMM use in 36% of incident response cases and 59% of ransomware cases tied to remote access. The practical shift is from simply knowing which tools exist to correlating first-seen usage, prevalence, and sanctioned access so abuse becomes visible before it blends into normal operations.

Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “RMM Hunting: LOLRMM for Detections”.

By the numbers:

• Huntress reported a 277% increase in RMM abuse last year, according to Abstract Security.
• Arctic Wolf saw RMM use in 36% of its incident response cases from the preceding quarter, according to Abstract Security.
• Abstract Security says 59% of ransomware cases were traced back to remote access with RMMs, VPN, and RDP abuse.

Key questions

Q: What breaks when organisations rely only on tool inventories for RMM control?

A: Inventory alone tells you what exists, not whether it was introduced appropriately or used maliciously.

Q: Why do trusted remote access tools create more risk than obvious malware?

A: Trusted RMM tools reduce attacker effort because they already look like normal administration and often have signed binaries, outbound connectivity, and unattended features.

Q: What are the signs that RMM abuse is already bypassing control boundaries?

A: Look for first-seen usage, multiple remote tools on the same endpoint, RMM execution from unusual paths, suspicious parent or child processes, and remote access that follows close on the heels of phishing or help desk impersonation.

Practitioner guidance

• Implement first-seen RMM detection Create user- and host-level baselines so newly observed RMM activity is flagged when it appears outside established patterns of administration.
• Correlate RMM telemetry with identity and endpoint events Join remote tool activity with phishing, help desk impersonation, service installs, and unusual parent-child process chains to raise fidelity.
• Normalize and enrich multi-artifact indicators Use process metadata, signer details, domains, service artefacts, registry keys, and paths so renamed binaries do not evade detection.

Bottom line: RMM abuse persists because trusted administration tools can be used as intrusion infrastructure without immediately looking malicious.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →