How we built it: Expel’s latest RMM detections

This post describes how a security team developed and tuned five layered detections to identify malicious use of remote monitoring and management (RMM) tools—covering detection of known-but-uncommon RMMs, multiple RMMs on one host, correlated RMM network connections, detections for RMMs considered always malicious, and RMMs using non-standard ports—and shows example alerting and tuning (including auto-closing frequent benign RMM alerts) that reduced noise and helped surface suspicious activity such as customer pen tests.