Hunting for Remote Management Tools

This blog post from the NVISO Incident Response team highlights how legitimate Remote Management and Monitoring (RMM) tools—such as TeamViewer, AnyDesk, VNC, and ScreenConnect—are prevalent in enterprises and increasingly abused by adversaries for stealthy access and persistence. It recommends standardizing and limiting approved RMM tools, enabling comprehensive logging, conducting routine audits, and hunting for anomalous installations and activity (including portable versions and provider URLs) to mitigate risk and improve detection.