Our remote monitoring tool can show that a session happened, but that does not tell us whether the person using an admin account was authorized. What data is useful for detecting abuse without alerting on every overnight maintenance job? Is a jump host or privileged access layer worth adding?
How can we tell a compromised RMM session from normal admin work?
Asked by
PAPER HAT THEORY
Answers
Baseline the admin and the context, not just the tool or the hour. Look at the account, source device and IP, target endpoints, session time, and what happened immediately after connection. An unfamiliar combination is more useful than a blanket alert for activity at 2am.
Send session starts and ends, identity, source, target, and available action logs to your SIEM. Correlate them with maintenance windows and tickets where you can. A ticket is helpful context, not proof that the session was legitimate.
Reply to this answer
Pair the RMM logs with endpoint detection logs. The RMM side may tell you which account opened the session, while the endpoint side can show processes spawned by the agent and their command lines.
Reconnaissance commands, encoded PowerShell, or an unusual burst of activity after a connection are worth investigating. None is automatically malicious, so compare them with the account's usual work and the reason for the session before treating them as a confirmed compromise.
Reply to this answer
On the prevention side, named admin identities make a big difference. Shared credentials muddy the trail even if you can see who retrieved a password from a vault. Just-in-time access or approvals can narrow the window, and a brokered access path can add another place to enforce and log access.
A jump host or privileged access layer can be worth evaluating, but it adds operational work. Check whether it actually covers the RMM access paths you use and whether the resulting logs can be tied back to individual sessions.
PAPER HAT THEORY:
So vault retrieval is useful correlation, but it does not by itself prove who operated the session?
unreasonably_early_for_chess:
Right. A retrieval event can help narrow the timeline, but shared credentials still leave uncertainty about who used them.
Reply to this answer
Also watch for remote access tools that are not approved in your environment. A near-real-time process detection can give you a separate signal from abuse of your existing RMM. Keep an inventory of expected tools and tune the rule for teams that legitimately support customers using different products.
Reply to this answer
Add your answer
Answers are reviewed before publication.
lighthouse_keeper_on_break:
Scheduled patching can be its own baseline too. Otherwise a legitimate automation account may look unusual whenever it runs overnight.