Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: persistence

Phishing Abuses RMM Tools for Persistent Access

Posted on September 30, 2026 by Kyle

Overview

This report details recent phishing campaigns observed by Microsoft that exploit legitimate Remote Monitoring and Management (RMM) tools. Attackers are using MSP360 RMM to deploy ScreenConnect, creating redundant and persistent remote access channels. This strategy allows threat actors to maintain control over compromised environments for follow-on activities, posing a significant risk to organizations utilizing or exposed to these tools.

Technical Analysis

  • Initial Access: Phishing campaigns serve as the initial vector, compromising user credentials or tricking users into executing malicious payloads.
  • Tool Deployment: Upon successful initial compromise, attackers deploy MSP360 RMM (formerly CloudBerry Remote Assistant) to gain initial remote control.
  • Redundant Access: MSP360 RMM is then leveraged to deploy ScreenConnect (ConnectWise Control), establishing a secondary, persistent remote access channel.
  • Purpose: This creates multiple avenues for remote control and persistence, enhancing attacker resilience against detection or remediation efforts and facilitating long-term access.
  • Affected Tools: MSP360 RMM, ScreenConnect (ConnectWise Control).

Detection

  • Monitor for the installation of legitimate RMM software (e.g., ScreenConnect.exe, cbsa.exe for MSP360 RMM) on endpoints where it is not explicitly authorized or expected by IT administration.
  • Look for suspicious process parent-child relationships, such as powershell.exe or cmd.exe spawning RMM installer executables or their agents.
  • Analyze network traffic for connections from RMM tool processes to unexpected or unapproved external IP addresses or domains.
  • Review endpoint logs for unusual service creations or modifications related to RMM tools, especially those configured for automatic startup.
  • Hunt for ScreenConnect.exe or cbsa.exe processes running on non-IT administration workstations or servers.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious RMM Agent Process Creation

title: Suspicious RMM Agent Process Creation
id: 4d1e2f3a-5b6c-4d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects the creation of processes associated with legitimate RMM tools (ScreenConnect, MSP360 RMM) that could be abused by attackers.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith:
      - '\ScreenConnect.exe'
      - '\cbsa.exe'
  condition: selection
level: high

RMM Tool Initiating Network Connection

title: RMM Tool Initiating Network Connection
id: 7e8f9a0b-1c2d-3e4f-5a6b-7c8d9e0f1a2b
status: experimental
description: Detects network connections initiated by ScreenConnect or MSP360 RMM agents, which could indicate active remote control or data exfiltration.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\ScreenConnect.exe'
      - '\cbsa.exe'
  condition: selection
level: medium

Mitigations

  1. User Awareness Training: Educate users on identifying and reporting phishing attempts, especially those involving social engineering tactics to install software or grant remote access.
  2. Multi-Factor Authentication (MFA): Implement MFA for all remote access services, critical accounts, and RMM tool access to prevent unauthorized access even if credentials are stolen.
  3. Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious process execution, file modifications, and network connections indicative of RMM tool abuse.
  4. Application Whitelisting/Control: Restrict the execution of unauthorized applications, including RMM tools, to only approved software and specific user groups.
  5. Network Segmentation: Isolate critical systems and segment networks to limit lateral movement and the scope of compromise if an endpoint is breached.
  6. Monitor RMM Tool Usage: Strictly monitor and audit the legitimate use of RMM tools, ensuring they are only deployed and accessed by authorized personnel from approved locations and for documented purposes.

References

  • https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1566.001 — Spearphishing Attachment
  • T1219 — Remote Access Tools
  • T1133 — External Remote Services
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,587 input / 1,277 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in phishingTagged high, msp360, persistence, phishing, rmm, screenconnect, windowsLeave a comment

NeedyMantis: Modular Post-Compromise Malware Framework

Posted on September 28, 2026 by Kyle

Overview

NeedyMantis is a modular post-compromise malware framework used in targeted intrusions. It leverages custom loaders, encrypted archives, and extensible components to establish and maintain long-term access, enabling subsequent malicious operations. Microsoft Threat Intelligence identified this framework in use against specific targets.

Technical Analysis

  • NeedyMantis operates as a modular framework, allowing threat actors to deploy various components as needed.
  • It utilizes custom loaders, suggesting a tailored approach to initial execution and evasion.
  • The framework employs encrypted archives, likely for storing its components, exfiltrating data, or obscuring malicious payloads.
  • Designed for extensibility, indicating a capability for threat actors to adapt and expand its functionalities post-compromise.
  • The primary objective is to maintain long-term access within compromised environments and support follow-on activities.

Detection

  • Monitor for suspicious process creation chains, particularly legitimate processes (e.g., svchost.exe, explorer.exe) spawning unusual executables in non-standard paths.
  • Look for the creation or modification of encrypted archive files (e.g., .zip, .rar, .7z) in unexpected directories, especially by processes not typically associated with archiving.
  • Analyze network traffic for unusual outbound connections to unknown or suspicious IP addresses and domains, indicative of command-and-control (C2) communication.
  • Hunt for registry modifications or scheduled tasks establishing persistence, especially those pointing to newly created or modified executables.
  • Monitor for unusual file system activity, such as the creation of hidden files or directories, or modifications to system binaries.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Process Spawning from Legitimate Parent

title: Suspicious Process Spawning from Legitimate Parent
id: 9c1d2e3f-4a5b-6c7d-8e9f-0123456789ab
status: experimental
description: Detects suspicious process creation where a common legitimate Windows process spawns an unusual executable in a non-standard path, indicative of a custom loader or malware execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\svchost.exe'
      - '\\explorer.exe'
      - '\\lsass.exe'
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
    Image|endswith:
      - '.exe'
      - '.dll'
    CommandLine|contains:
      - ' -load'
      - ' -exec'
  condition: selection
level: high

Creation of Encrypted Archive in Suspicious Location

title: Creation of Encrypted Archive in Suspicious Location
id: a1b2c3d4-e5f6-7a8b-9c0d-1234567890ef
status: experimental
description: Detects the creation of common encrypted archive file types in user profile or system temporary directories, which could indicate data staging for exfiltration or malware component storage.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11 # FileCreate
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.gz'
      - '.tar.gz'
    TargetFilename|contains:
      - 'C:\Users\'
      - 'C:\Windows\Temp\'
      - 'C:\ProgramData\'
  condition: selection
level: medium

Registry Persistence via Run Key for Suspicious Path

title: Registry Persistence via Run Key for Suspicious Path
id: b2c3d4e5-f6a7-8b9c-0d1e-2345678901fg
status: experimental
description: Identifies modifications to common Windows Run registry keys that point to executables in non-standard or temporary directories, a common persistence mechanism for malware like NeedyMantis.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 13 # RegistryEvent (Value Set)
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Run\'
      - 'Software\Microsoft\Windows\CurrentVersion\RunOnce\'
    Details|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
      - 'C:\PerfLogs\'
      - '.exe'
      - '.dll'
  condition: selection
level: high

Mitigations

  1. Implement robust Endpoint Detection and Response (EDR) solutions to detect and respond to post-compromise activities, including suspicious process execution and file modifications.
  2. Enforce application whitelisting or strong application control policies to prevent the execution of unauthorized or unknown executables and scripts, including custom loaders.
  3. Regularly patch and update all operating systems, applications, and network devices to remediate known vulnerabilities that could be exploited for initial access.
  4. Implement network segmentation and egress filtering to limit lateral movement and restrict outbound connections to only necessary and approved destinations.
  5. Conduct regular security audits and penetration testing to identify and address weaknesses in your environment before they can be exploited.

References

  • https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1055 — Process Injection
  • T1071.001 — Web Protocols
  • T1560.001 — Archive via Utility
  • T1105 — Ingress Tool Transfer
  • T1547.001 — Registry Run Keys / Startup Folder
  • T1090 — Proxy
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,611 input / 1,597 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in malwareTagged high, malware, persistence, post-compromise, targeted-attack, windowsLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.