Lion Cipher Lab
Hunt unsanctioned remote access tools (RMM) across a fleet
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
When an intruder or a tech-support scammer wants hands-on-keyboard control of a computer, they increasingly skip custom malware and install the same remote support software your own help desk uses. It is signed by a real company, antivirus trusts it, and its traffic looks like a support session. CISA, the NSA and MS-ISAC published a joint advisory in 2023 about exactly this: federal employees were phished into running portable copies of remote access tools, and the operators then used the live session to run a refund scam against the victims' bank accounts. You cannot alert on 'remote access…
What you'll learn
- Explaining why attackers prefer legitimate, signed remote monitoring and management (RMM) software, and mapping it to MITRE ATT&CK T1219
- Using Sysmon's OriginalFileName field to see through a renamed binary
- Turning an RMM inventory (sanctioned product, install path, launching parent, approved exceptions) into a hunt rule
- Joining DNS events to process events by ProcessGuid to catch an RMM product your catalog does not know
- Measuring precision and recall of four hunts against a labeled fleet dataset
- Naming what an RMM hunt still misses, and the prevention controls (application control, egress blocking, inventory) that back it
Steps in this lab
- What 'remote access tool abuse' is, and why attackers like it
- Why the obvious rule fails (the judgement)
- The three fields that carry the signal
- Build the synthetic fleet
- Write four hunts and score them
- Read the results like an analyst
- Where the domains and names come from: maintain the catalog
- Optional: look for renamed programs on your own PC (read-only)
- What this hunt still misses
- Prevention that makes the hunt quieter
- Where this goes next