Attackers increasingly bring their own remote management platform: a free, open-source tool such as RustDesk, MeshCentral or Tactical RMM, running on a server they control, so there is no vendor account to suspend and no shared cloud domain to block. These tools give an intruder an interactive desktop, a shell and file transfer that survive password resets and look like ordinary IT administration. This guide describes what each of the three leaves on a host and on the network, the detection rules that catch them, and the controls that stop them being installed. It is for SOC analysts, detection engineers and endpoint administrators who already manage a sanctioned remote management tool and need to find the ones they did not approve.
This is an independent guide from NHI Mgmt Group, based on the public documentation of MeshCentral, RustDesk and Tactical RMM, MITRE ATT&CK and government advisories as of November 2026. It is not sponsored or reviewed by any of these projects, and it covers detection only.
Key takeaways
- Self-hosting changes the detection model. With commercial RMM you can watch for the vendor's cloud domains; with RustDesk, MeshCentral and Tactical RMM the server address is whatever the attacker configured, so host artefacts and configuration files matter more than domain lists.
- Each tool has a stable fingerprint. RustDesk installs a service named RustDesk run with --service; MeshCentral installs "Mesh Agent" with a MeshAgent.msh config; Tactical RMM installs under C:\Program Files\TacticalAgent\ and, by default, a Mesh Agent as well.
- Real groups use them. ATT&CK records ShinyHunters deploying MeshCentral agents disguised as Azure services, the FBI and CISA list Tactical.RMM among Scattered Spider tools, and The DFIR Report documented RustDesk as the re-entry path in a 2026 Akira intrusion.
- Service installation is the highest-value event. Windows System Event ID 7045 from the Service Control Manager catches all three when installed for unattended access, which is what an attacker wants.
- Allowlist one tool and block the rest. CISA's guidance is to audit which remote tools are authorised, allowlist them, and block both installation and portable execution of everything else.
Why open-source RMM is attractive to intruders
Remote access tools sit under ATT&CK T1219 Remote Access Tools, with interactive desktop products under T1219.002 Remote Desktop Software. The joint CISA, NSA and MS-ISAC advisory on malicious RMM use (AA23-025A, January 2023) explains the appeal: legitimate software is trusted by users and security tools, portable versions run without administrator rights, and any RMM product can be abused. Open-source, self-hosted tools add three properties that commercial tools lack:
- No vendor control point: there is no licence to revoke and no abuse desk that can disable the attacker's tenant.
- Attacker-chosen infrastructure: the rendezvous, relay or management server is a host the attacker rents, so domain and IP indicators change per intrusion.
- Customisation: binaries can be renamed, rebranded or rebuilt. ATT&CK records ShinyHunters naming MeshCentral agents meshagent32-azure-ops.exe and meshagent64-azure-ops.exe (T1036.005 Match Legitimate Resource Name or Location).
| Tool | Architecture | Capabilities an intruder uses | Documented abuse |
|---|---|---|---|
| RustDesk | Client plus ID server (hbbs) and relay server (hbbr), public or self-hosted | Unattended remote desktop, file transfer, clipboard, TCP port forwarding | Installed as a service and used to re-enter and pivot by RDP before Akira deployment (The DFIR Report, June 2026) |
| MeshCentral | Self-hosted Node.js web server; MeshAgent on each device | Remote desktop, terminal, file access, port forwarding, scripted commands via meshctrl.js | ShinyHunters initial access and command execution with disguised agents (ATT&CK G1057) |
| Tactical RMM | Self-hosted RMM; own agent plus MeshCentral for remote control | Scripts, remote shell, software deployment, "Take Control" desktop via Mesh | Listed in the Scattered Spider tool table (AA23-320A) |
RustDesk: artefacts and detections
RustDesk's self-hosting documentation describes two server components: hbbs, the ID and rendezvous server that registers devices and brokers hole punching, and hbbr, the relay used when a direct connection fails. The core ports are TCP 21114 to 21119 and UDP 21116: 21115 for the NAT type test, 21116 TCP and UDP for registration and hole punching, 21117 for relay, and 21118 and 21119 for WebSocket clients, with 21114 used only by the Pro API. Clients are pointed at a custom server by setting the ID server, relay and the server's public key (id_ed25519.pub) in Network settings, or by importing a config string with rustdesk.exe --config.
| Artefact | Value | Detection use |
|---|---|---|
| Service install | System Event ID 7045, service name RustDesk, image path "C:\Program Files\RustDesk\RustDesk.exe" --service | Alert on any host not in the approved list |
| Registry | HKLM\SYSTEM\CurrentControlSet\Services\RustDesk; uninstall key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk | Hunting and inventory |
| Config | %APPDATA%\RustDesk\config\RustDesk2.toml (per user) and C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.toml (service) | Reveals custom rendezvous and relay servers, the attacker's infrastructure |
| Command lines | --silent-install, --password, --config, --get-id, --tray, --cm | --password and --config from a script or remote shell signal unattended set-up |
| Persistence | Startup shortcut RustDesk Tray.lnk in the all-users Startup folder | File creation alert |
| Network | DNS for rs-*.rustdesk.com (public servers) or connections to TCP 21115 to 21117 on an unknown host | SigmaHQ's remote access domain rule matches rs- prefixed rustdesk.com queries from non-browser processes |
In the 2026 Akira case, the attacker used RDP to install RustDesk as a Windows service on two servers, ran it in tray mode, and returned two days later: a Type 2 logon (Event ID 4624) from 127.0.0.1 followed by RustDesk.exe --cm marked the interactive session. The report is clear that this sequence was specific to the case, but a loopback interactive logon followed by a remote access process is a pattern worth hunting.
MeshCentral: artefacts and detections
MeshCentral is a full web-based management server: the operator creates a device group, installs an agent on each machine, and gets remote desktop, terminal and file management. The server listens on TCP 443 by default, so agent traffic blends with HTTPS. On Windows the agent installs as C:\Program Files\Mesh Agent\MeshAgent.exe with a MeshAgent.msh file beside it that holds the server address and settings; on Linux and macOS the equivalent path is /usr/local/mesh_services/meshagent/.
- Service install: System Event ID 7045 with an image path containing MeshAgent.exe or a service name containing "Mesh Agent" (SigmaHQ "Mesh Agent Service Installation").
- Renamed agent: any process whose command line contains --meshServiceName, or whose OriginalFileName contains meshagent while the image is not meshagent.exe (SigmaHQ renamed MeshAgent rules for Windows and macOS). This is how the ShinyHunters "azure-ops" binaries would surface.
- Command execution: cmd.exe, powershell.exe or pwsh.exe spawned by meshagent.exe (SigmaHQ "MeshAgent Command Execution via MeshCentral"). Legitimate administrators do this too, so tune on the parent's MeshAgent.msh server value.
- Configuration: read MeshAgent.msh on any unexpected agent; the server host it names is the attacker's management server and should be blocked and reported.
Tactical RMM: artefacts and detections
Tactical RMM is a self-hosted remote monitoring and management platform with its own agent. Its documentation shows the agent under C:\Program Files\TacticalAgent\ with working data under C:\ProgramData\TacticalRMM\, and an installer that pulls in the MeshCentral agent for its "Take Control" remote desktop unless the --nomesh flag is used. A Tactical RMM intrusion therefore usually produces the MeshCentral artefacts above as well.
- Service install: System Event ID 7045 with image path containing tacticalrmm.exe or service name containing "TacticalRMM Agent Service" (SigmaHQ "TacticalRMM Service Installation").
- Registration to a server: tacticalrmm.exe under \TacticalAgent\ run with --api, --auth, --client-id, --site-id and --agent-type together, which binds the agent to a specific RMM server. SigmaHQ's rule for this flags possible registration to an attacker-controlled server; compare the --api URL with your own instance.
- Silent install: the installer's --silent flag suppresses dialogs; combined with a download from a newly seen domain it indicates scripted deployment.
- Paired Mesh Agent: a Mesh Agent service appearing within minutes of a Tactical agent on a host where neither is approved.
Detection rules at a glance
| Rule | Data source | Fidelity | Notes |
|---|---|---|---|
| Service install of RustDesk, Mesh Agent or TacticalRMM | System log Event ID 7045 | High where none is approved | Covers unattended access, the mode intruders want |
| Renamed MeshAgent or RustDesk | Process creation (Sysmon Event ID 1) | High | Match OriginalFileName and command-line switches, not image name |
| Agent registration flags | Process creation | High | Tactical --api/--auth; RustDesk --config/--password |
| Shell spawned by remote access agent | Process creation with parent | Medium | Tune by approved server value |
| Config file naming an unknown server | File creation (Event ID 11) plus content collection | High | RustDesk2.toml, MeshAgent.msh |
| Remote access traffic to unknown hosts | DNS (Event ID 22), firewall, proxy | Medium | TCP 21115 to 21117 outbound; rs-*.rustdesk.com from non-browsers |
The LOLRMM project maintains per-tool artefact sheets and Sigma rules for files, processes, registry and network activity for all three tools, and is a good source for keeping these rules current. See the Sigma Rules Guide and the Windows Event Log Guide.
Where identity fits
Unattended remote access is a standing credential. A RustDesk permanent password set with --password, a MeshCentral device group invitation or a Tactical RMM agent auth token gives whoever holds it SYSTEM-level control without touching your identity provider, conditional access or MFA. Treat approved agents and their server accounts as privileged non-human identities: inventory them, store their secrets in a vault, require MFA on the management console, and review who can deploy agents. An unapproved agent is effectively a backdoor account that your joiner, mover and leaver process will never remove. See the Securing the remote monitoring and management (RMM) tool itself guide and the Privileged Access Management Guide.
Prevention and hardening
- Approve one remote management tool: document it in policy and allowlist it by publisher. Block RustDesk, MeshAgent and Tactical agents elsewhere by hash, product name and path with application control. See the App Control for Business (WDAC) guide.
- Block portable execution: AA23-025A specifically recommends blocking both installation and execution of portable versions of unauthorised RMM software.
- Restrict outbound ports and categories: block TCP 21115 to 21117 and UDP 21116 outbound where RustDesk is not used, and block remote access categories at the proxy.
- Require approved RMM to run through the corporate path: CISA recommends limiting approved RMM to use from inside the network or over VPN or VDI.
- Restrict service creation: standard users should not be local administrators; most unattended installs need admin rights. Use Windows LAPS for local administrator passwords.
Implementation: a phased rollout
- Discover (week 1): hunt 90 days of Event ID 7045, process creation and installed-software inventory for RustDesk, Mesh Agent and Tactical agents. Record every hit with owner and justification.
- Decide (week 2): confirm the single sanctioned remote management tool and its server addresses. Any MeshCentral or Tactical server you run belongs in the inventory with its URL.
- Alert (week 2 to 4): deploy service install and renamed agent rules in alert mode, excluding only the sanctioned server values. Route hits to a triage step that checks the config file's server address.
- Test (week 4): in a lab, install each tool against a test server, including a renamed MeshAgent and a RustDesk --config import, and confirm each rule fires and the analyst can identify the server.
- Enforce (week 4 to 8): move application control blocks from audit to enforce in pilot rings (IT, then servers, then all endpoints). Roll back a ring to audit mode if a line-of-business process breaks, and add a narrow exception.
- Respond: on an unapproved agent, isolate, preserve config and logs, block the server, then uninstall and review every account active during agent sessions. Follow the Unauthorised Remote Monitoring and Management Tool Playbook.
Decision guidance
- You use one of these tools legitimately: keep it, but alert on any instance whose config names a server other than yours. The server address is the dividing line between administration and intrusion.
- You use a commercial RMM: block all three open-source tools outright; there is little reason for them to appear.
- Small organisation or MSP customer: application control plus outbound port blocking delivers most of the value; ask your MSP which tools and server addresses they use so you can tell theirs from an intruder's.
- Large estate: add automated config collection on alert and an enrichment step that checks the server address against your inventory and threat intelligence.
Measuring whether it works
- Unapproved agents: count of hosts with a non-sanctioned remote access agent, trending to zero.
- Telemetry coverage: percentage of endpoints forwarding System Event ID 7045 and process creation with command line.
- Detection test rate: share of quarterly emulations (one per tool, plus a renamed agent) detected within 15 minutes.
- Dwell time: median time from agent installation to removal.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK | T1219, T1219.002, T1543.003 Windows Service, T1036.005, T1105 Ingress Tool Transfer, T1588.002 Tool | Behaviours to detect |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-PSA Process Spawn Analysis, D3-OTF Outbound Traffic Filtering | Countermeasures |
| NIST SP 800-53 Rev. 5 | AC-17 Remote Access, CM-7(5) Authorized Software, CM-11 User-installed Software, SI-4 System Monitoring | Policy, software control and monitoring |
| NIST CSF 2.0 | PR.PS-05, DE.CM-09 | Prevent and detect unauthorised software |
| CIS Controls v8.1 | 2.3 Address Unauthorized Software, 2.5 Allowlist Authorized Software | Inventory and allowlisting |
| ISO/IEC 27001:2022 Annex A | 8.19 Installation of software on operational systems, 8.16 Monitoring activities | Control objectives for audit |
Common failure patterns
- Domain-only blocking: blocking rustdesk.com does nothing against a self-hosted hbbs server.
- Trusting the name: renamed agents such as meshagent64-azure-ops.exe pass a casual review of services.
- Allowing "any RMM the MSP uses": without server addresses you cannot tell an MSP agent from an intruder's identical one.
- Missing the second tool: responders who remove a Tactical agent but not its Mesh Agent leave the remote desktop in place.
- Help desk social engineering: the MGM Resorts Breach 2023 was attributed to Scattered Spider, a group whose advisory lists Tactical.RMM among its tools; remote access installs that follow a help desk call deserve scrutiny.
Practitioner checklist
- Hunt Event ID 7045 and process telemetry for RustDesk, Mesh Agent and Tactical agents.
- Name one sanctioned remote management tool and record its server addresses.
- Deploy service install, renamed agent and registration flag rules.
- Collect RustDesk2.toml and MeshAgent.msh automatically when a rule fires.
- Block unapproved agents and their portable versions with application control.
- Block outbound TCP 21115 to 21117 and UDP 21116 where RustDesk is not approved.
- Treat agent passwords, tokens and console accounts as privileged credentials.
- Emulate each tool quarterly and record detection time.
Standards and references
- CISA, NSA and MS-ISAC: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
- MITRE ATT&CK: Remote Desktop Software (T1219.002)
- MITRE ATT&CK: ShinyHunters (G1057)
- FBI and CISA: Scattered Spider (AA23-320A)
- RustDesk: Self-host documentation
- Tactical RMM: Installing an agent
- LOLRMM: Living off the land RMM project
- The DFIR Report: From Bing Search to Ransomware, Bumblebee and AdaptixC2 Deliver Akira
Related NHI Mgmt Group resources: RMM Tool Security Guide · MITRE ATT&CK T1219 Remote Access Tools · Unauthorised Remote Monitoring and Management Tool Playbook · ShinyHunters Threat Actor Profile · Detecting Rclone and File-Sync Exfiltration Tooling