Remote monitoring and management abuse
Remote monitoring and management abuse is the unauthorized use of legitimate administration software to obtain or maintain remote access to systems.
Who controls the tool?
RMM software lets IT staff or a managed service provider monitor and administer devices remotely. Abuse starts when someone uses those capabilities without permission. The software can be genuine while the operator or the activity is unauthorized.
The joint CISA, NSA, FBI, MS-ISAC, and INCD guide describes attackers using compromised remote-access credentials as well as deploying their own tools. An unexpected installation and misuse of an approved management account therefore need different investigations.
An installed-software list is only a starting point
Some remote-access tools run as portable executables without installation. An inventory can miss those sessions. Conversely, an installed agent may be entirely legitimate. Check the account controlling it, the devices that account can reach, and the activity recorded on the affected endpoint.
The guide also describes attackers keeping several remote-access methods available. Closing one session does not establish that access has ended. During incident containment, identify the other accounts, tools, and connections involved before treating the device as contained.
For the support-call route into this problem, see fake IT remote support. The broader remote access software entry explains the capabilities a legitimate session may grant.