Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

A remote access tool nobody installed

Legitimate remote management software is a favourite backdoor because it is signed, trusted by security tools and looks like IT at work. CISA has documented criminals using it for refund scams and for holding access to an estate. The question is not whether the software is malicious. It is whose account is on the other end.

Trigger. AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop or something like them appears on a host where IT does not use it, or a sanctioned tool connects to an account or relay you do not own.

The first 90 minutes2 of 5 expire
045 min90
  1. 01

    Isolate the host and block the relay

    by 10 minexpires

    Isolate through EDR rather than pulling the cable, so collection still works. If IT does not use this product anywhere, block the vendor's relay domains at the proxy or firewall, which stops every copy at once, including the ones you have not found yet.

  2. 02

    Collect the tool's own logs and the install evidence

    by 25 minexpires

    Most of these tools keep a connection log with the remote ID, the peer address and session times. AnyDesk, for example, writes ad_svc.trace and connection_trace.txt under ProgramData. The install itself shows in Prefetch, Amcache and, for MSI packages, the MsiInstaller events 1033 and 11707 in the Application log.