Note: ctfmon.exe is a renamed version of NetSupport binary.Īdversaries frequently rename binaries, as shown above, in an effort to evade overly specific detections. In the below instance, we would qualify the copy of NetSupport as “suspect” based on the directory and process name.

executing from directories outside of the usual “program files” folder.

renaming the primary NetSupport binary, client32, to something else.

In the case of one remote administration tool, known as “NetSupport,” malicious usage can usually be distinguished by a few factors: On top of this, each tool’s execution behaviors vary, which makes answering the questions above a time-consuming process for analysts. Detection engineers want to cut through the noise as much as possible and find anomalies in vast data sets. Basically, you will take a baseline of the application’s behavior and apply best efforts to writing detection logic on commonly observed techniques that adversaries employ. The goal of this admittedly non-comprehensive list of questions is to detect abnormalities in your telemetry.

Is this software approved in my environment?.

What do these tools typically write to the filesystem?.

Where does it normally establish connections to?.

Which directory does it normally execute from?.

With each of these tools, you’ll need to “know normal,” as SANS says, and ask behavioral questions of each tool. The primary difference between a “trojan” and a “tool” is whether or not your organization still has control over the software, but determining that can be tricky. Once an adversary gets their hands on it, a remote administration tool can become a remote access trojan. Similar to how we detailed the various exfiltration tools used by adversaries during ransomware extortion, in this post we’ll discuss why it’s important to monitor RMM software in your enterprise, and we’ll offer detailed guidance on how to observe and detect it. In fact, just last week AdvIntel reported on adversaries who-after gaining initial access-had installed an RMM tool called Atera and used it as a functional backdoor in the lead up to a Conti ransomware outbreak. These tools perform reliably, as you may expect with most enterprise software, and allow operators to pivot and transfer data to and from victim machines.Īdversarial abuse of remote monitoring & management (RMM) software is not new, but-given the rash of costly and destructive ransomware attacks in recent months and years-it’s particularly important that security teams develop robust security controls for detecting malicious use of RMM tooling. Red Canary’s Cyber Incident Response Team frequently observes adversaries abusing legitimate remote access utilities for lateral movement and execution of payloads.

Remote utilities host