Detect Pasam by correlating suspicious persistence, remote control activity, and command execution on endpoints that should not be receiving administrative instructions. Review processes, autoruns, and outbound connections for signs of covert access from external operators. If the host shows unexplained configuration changes or lateral movement, treat it as compromised and verify neighbouring systems.
How Pasam typically shows up on endpoints
Pasam detection starts with behaviour, not a signature. The strongest indicators are endpoint activity that looks like covert administration: persistence that reappears after reboot, remote command execution on systems that should not accept it, and processes that spawn unusual child processes or script interpreters. A single sign is rarely enough, but a cluster of persistence plus operator-style execution is meaningful.
Focus on the endpoint record as a timeline. Review services, scheduled tasks, autoruns, WMI subscriptions, login scripts, and similar persistence points for changes that do not match the host’s normal role. If those changes coincide with remote shells, off-hours execution, or tools that normally belong to administrators, treat the host as an active investigation target rather than a routine alert.
What telemetry most often reveals covert operator access
Pasam is most visible when defenders correlate endpoint telemetry with network telemetry. Look for outbound connections from a workstation or server to infrastructure it has no business contacting, especially when those connections line up with command execution, file drops, or new persistence. Unexplained configuration changes and lateral movement are especially important because they suggest the operator has already moved beyond initial access.
Security teams should also compare user context, process lineage, and destination patterns. A benign management tool used in the wrong security context can be a clue, but repeated use of remote administration channels from an unexpected source or account is more significant. The practical question is whether the system is receiving instructions from an authorised operator path or from a covert one.
For a deeper threat-hunting baseline on malware behaviours, process abuse, and evasion patterns, see Malware Guide.
When to treat the host as compromised
If the host shows persistence plus remote control activity, assume the adversary has established durable access. At that point, the issue is no longer just detection, it is containment and scope assessment. A compromised endpoint can become a staging point for credential theft, lateral movement, or further tool deployment, so the investigation should expand outward from the first alert.
The most useful pivot is to identify whether neighbouring systems show the same operator tradecraft: similar persistence points, the same command patterns, or the same external destinations. That tells you whether you are dealing with one isolated machine or a wider intrusion. If multiple hosts share the same signals, the response should move from host-level cleanup to campaign-level containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1053 — Scheduled Task/Job | Pasam-like persistence often uses scheduled execution on endpoints. |
| T1021 — Remote Services | Remote control activity on endpoints maps to adversary remote access and administration behaviour. | |
| T1071 — Application Layer Protocol | Outbound connections to operator infrastructure often blend into normal application traffic. | |
| Recommendation — Hunt for persistence mechanisms that schedule or re-run commands automatically. Correlate remote service use with unexpected operator commands and logon paths. Inspect suspicious outbound channels for command-and-control patterns and unusual destinations. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and Events Are Monitored | Detecting Pasam depends on continuous monitoring of endpoint and network anomalies. |
| RS.AN-01 — Investigate Incidents | Once compromise indicators appear, the response requires structured investigation and scoping. | |
| Recommendation — Monitor endpoint and network telemetry for persistence, remote access, and lateral movement indicators. Investigate correlated endpoint and network evidence to scope the compromise. | ||
Practitioner Guidance
What to prioritise: Correlate endpoint persistence with remote execution and outbound connectivity before you spend time on malware naming. The combination matters more than any single IOC because Pasam-like activity is often operationally quiet until the operator starts issuing commands.
What to verify: Confirm whether the affected endpoint should ever receive administrative instructions from that source, account, or process path. If the answer is no, verify recent configuration changes, new services, scheduled tasks, and adjacent systems before declaring the alert isolated.
Escalation / exception: Escalate immediately if the host has unexplained configuration drift, repeated reconnects to the same external endpoint, or signs of lateral movement. In that case, treat the system as compromised and preserve evidence before remediation actions remove the operator’s trail.
Practitioner takeaway: The fastest way to miss Pasam is to look at one artefact in isolation; the right approach is to connect persistence, remote execution, and network behaviour into one compromise story.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org