HUNTING FOR REMOTE MANAGEMENT TOOLS: DETECTING RMMS

Summary from the TLDR InfoSec newsletter

This blog post discusses hunting for Remote Management and Monitoring (RMM) tools in organizations, highlighting challenges in identifying different tools. By searching for keywords in various fields like filenames and process command lines, the likelihood of detecting RMMs increases. The query language used to search through SIEM logs helps optimize the process by attributing events to specific RMM tools based on identified keywords.