RMM abuse: are your detections keeping up with attacker tradecraft?

TL;DR: Noisy remote monitoring and management tooling is difficult to detect because the same software has legitimate and malicious uses, according to Expel, so it built five new detections to improve context, cut false positives, and flag suspicious combinations such as multiple RMMs on one host. The real lesson is that detection quality now depends on correlation and environment-specific baselines, not simple allowlists.

NHIMG editorial — based on content published by Expel: LLMjacking: How Attackers Hijack AI Using Compromised NHIs

By the numbers:

• This alone has closed 80% of alerts, making the remaining volume manageable for the SOC.

Questions worth separating out

Q: What breaks when remote monitoring and management tools are not baselined properly?

A: Teams lose the ability to tell legitimate support activity from attacker-controlled remote access.

Q: Why do attackers use multiple RMM tools on the same host?

A: They are testing which tool can bypass controls or survive blocking.

Q: How can security teams tell whether RMM detections are actually working?

A: Look for fewer noisy alerts, higher-confidence escalations, and faster analyst decisions on suspicious remote access events.

Practitioner guidance

• Build an RMM allowlist by business context Classify approved remote administration tools by host group, support team, and use case, then flag any RMM that appears outside its normal environment.
• Correlate process and network signals before escalating Combine source-process alerts, outbound connections to RMM domains, and multi-tool presence on the same host to raise confidence.
• Review non-standard port usage as an evasion indicator Treat RMMs running over unusual ports as a higher-risk signal because legitimate administrators rarely change that configuration.

What's in the full article

Expel's full article covers the operational detail this post intentionally leaves for the source:

• The exact five-detection logic used to distinguish benign from suspicious RMM activity across process, host, and network signals.
• Examples of how alert context changed severity and helped analysts triage a customer pen-testing scenario.
• The threshold logic behind auto-closing high-frequency alerts and why that reduced SOC noise.
• How Expel uses weekly review cycles to iterate on detection quality and tune suppression decisions.

👉 Read Expel's analysis of malicious RMM detection and alert context →

RMM abuse: are your detections keeping up with attacker tradecraft?

Explore further

View Full Forum →  |  NHI Foundation Course →