RUNBOOK // Rogue RMM (AnyDesk, ScreenConnect, Atera) Infestation Triage

SEVERITY 2 // HIGH LIVING-OFF-THE-LAND RMM Target Time to Contain: < 30 minutes

Ransomware groups (such as BlackCat, LockBit, Akira, and Royal) routinely deploy commercial Remote Monitoring and Management (RMM) tools - most notably AnyDesk, ScreenConnect (ConnectWise), Atera, Splashtop, and RustDesk.

Because these tools are digitally signed, valid administrative software, traditional antivirus engines do not flag them as malicious. Adversaries use them as redundant, high-bandwidth C2 channels that bypass standard EDR detections.

---

🎯 The Master RMM Forensic Identifier Table

Software	Executable Name(s)	Default Service Name	Default Path & Log Location
AnyDesk	AnyDesk.exe	AnyDesk	C:\Program Files (x86)\AnyDesk\ %APPDATA%\AnyDesk\ad.trace & connection_trace.txt
ScreenConnect	ScreenConnect.ClientService.exe	ScreenConnect Client (...)	C:\Program Files (x86)\ScreenConnect Client (...) user.config
Atera	AteraAgent.exe	AteraAgent	C:\Program Files\ATERA Networks\AteraAgent\
Splashtop	SRFeature.exe, SRServer.exe	SplashtopRemoteService	C:\Program Files (x86)\Splashtop\Splashtop Remote\
RustDesk	rustdesk.exe	rustdesk	C:\Program Files\RustDesk\ %APPDATA%\RustDesk\config\

---

⚡ Step 1: Fleet-Wide KQL Detection Query (Defender XDR)

Scans for process execution, service installation, or network connection events tied to unapproved RMM tools.

let RmmBinaries = dynamic([
    "anydesk.exe", "screenconnect.clientservice.exe", "ateraagent.exe",
    "srfeature.exe", "srserver.exe", "rustdesk.exe", "ninjaone.exe",
    "logmein.exe", "teamviewer.exe", "meshagent.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (RmmBinaries)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

---

🛑 Step 2: Emergency PowerShell Containment & Purge

If unauthorized RMM tools are running on an endpoint, execute this containment script via Live Response or local administrator shell:

# Terminate and Remove Rogue AnyDesk / ScreenConnect / Atera
$services = @('AnyDesk', 'AteraAgent', 'SplashtopRemoteService', 'rustdesk')
$processes = @('AnyDesk', 'ScreenConnect.ClientService', 'AteraAgent', 'SRServer', 'rustdesk')

# 1. Kill active processes immediately
foreach ($proc in $processes) {
    Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force -Verbose
}

# 2. Stop and disable associated Windows services
foreach ($svc in $services) {
    Get-Service -Name "$svc*" -ErrorAction SilentlyContinue | ForEach-Object {
        Stop-Service -Name $_.Name -Force
        Set-Service -Name $_.Name -StartupType Disabled
        sc.exe delete $_.Name
    }
}

Write-Host "[+] Rogue RMM services and processes neutralized." -ForegroundColor Green

---

🔬 Step 3: Carving Attacker Identifiers from RMM Logs

Do not delete the RMM directories without extracting the attacker’s Client ID, Relay Server IP, or Account Credentials:

1. AnyDesk Forensic Log Carving (ad.trace & connection_trace.txt)

Contains the incoming connection timestamp, remote AnyDesk ID (alias), and remote IP address:

# Extract remote AnyDesk ID and connecting IP from user profile and ProgramData
$traceFiles = @(
    "$env:ProgramData\AnyDesk\ad_svc.trace",
    "$env:APPDATA\AnyDesk\connection_trace.txt",
    "$env:APPDATA\AnyDesk\ad.trace"
)

foreach ($file in $traceFiles) {
    if (Test-Path $file) {
        Write-Host "=== CARVING: $file ===" -ForegroundColor Cyan
        Get-Content $file | Select-String -Pattern '(Logged in from|Connecting to|User-ID:|External IP:)' | Select-Object -Last 30
    }
}

2. ScreenConnect Server Carving (user.config)

Extracts the attacker’s self-hosted ScreenConnect relay URL/instance ID:

# Search for ScreenConnect relay URLs in config XML
Get-ChildItem -Path "$env:ProgramFiles (x86)\ScreenConnect Client*" -Filter "*.config" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    Get-Content $_.FullName | Select-String -Pattern 'https?://[a-zA-Z0-9.-]+\.screenconnect\.com|https?://[0-9.]+'
}

---

🧱 Step 4: Perimeter Firewall & DNS Sinkhole Blocklist

Block all egress communication to commercial RMM relay servers at enterprise firewalls:

• *.anydesk.com (Port 6568 TCP/UDP, 443 TCP, 80 TCP)
• *.screenconnect.com (Port 8040, 8041 TCP)
• *.atera.com (Port 443 TCP)
• *.rustdesk.com (Port 21115 - 21119 TCP/UDP)