Exploring RMM Tools and Their Forensics

Responders often struggle to find accurate, current guidance on remote monitoring and management tools, remote access software and remote desktop applications. The speaker describes outdated comparison articles, vendor-only documentation, and a case where an unfamiliar remote tool was installed by an attacker. Legitimate tools also blur the line between approved use and abuse, which makes attribution harder.

The approach was to set up clean Windows 11 virtual machines, install each application, and record the files it wrote before and after first use, along with its network behavior. Because these tools must beacon out to relay servers, network monitoring can reveal their presence even when endpoint inventory is incomplete. For AnyDesk, a connection trace file on the target host shows that a session was actually established, and it can expose the connecting IP, a session identifier, a linked account email, and recent file-transfer folders.

The talk stresses that Windows event logs rarely capture the install or ongoing use of these tools, so artifacts often sit in application data folders or the registry. In one case, blocking a tool's published domains on a Friday likely prevented a weekend ransomware deployment. Practical takeaways include standardising on a small approved set of remote tools, blocking unapproved ones by their documented domains and ports, and checking older guidance against current versions.