RMM abuse is when attackers use legitimate remote monitoring and management (RMM) and remote access tools, the same software IT teams use to support users, to gain persistent access that looks like ordinary administration. Huntress found RMM abuse in 45% of the endpoint-related incidents it investigated in the first quarter of 2026, which makes it the most common threat category in its data. Detection matters, but it depends on something simpler: knowing which remote access tools sit on every endpoint, and whether each one belongs on the device where it runs.
Why RMM Abuse Works
Attackers like these tools for the same reasons IT teams do. They run commands, move files, and keep a connection open across restarts. And because they are legitimate, security tools tend to wave them through. In a joint guide to securing remote access software, CISA, the FBI, the NSA, and partner agencies note that the software carries valid code-signing certificates, does not always trigger antivirus or EDR defenses, and often sits in install paths that teams exclude from inspection.
The tools also spare attackers the effort of building their own malware. The way an administrator uses remote access software to help a user looks much like the way an attacker uses it to control a device.
Getting the tool onto a device is often the easy part. Huntress describes a case where a fake service agreement got one remote access tool onto a device, and the attacker then stacked three more on top of it. One phishing click gave the attacker four separate ways back in. Huntress also reports that RMM abuse rose 277% year over year in 2025.
Why RMM Abuse Starts as an Inventory Question
Both sources begin their advice in the same place. Huntress tells readers to ask which remote monitoring tools the organization has approved, and what reveals an unapproved one. The first host-based control in the CISA guide is to audit remote access software on devices to identify which tools the organization uses and which it has authorized.
That is an inventory question before it is a detection question. An organization that cannot list the remote access tools on its endpoints cannot tell an attacker’s tool from its own. It is easy to end up with more of these tools than anyone planned: one for the helpdesk, one an outside vendor installed for its own support, one a department bought on its own, and old installations nobody removed.
How to Find RMM Abuse Risk Across Every Endpoint
Write Down What You Approved
List every remote access tool the organization uses on purpose: the product, who uses it, for what, and on which devices. Include the tools that vendors and service partners rely on to support their own systems. Any tool you later find on an endpoint that is not on this list is a finding to investigate, not a gap in the paperwork.
Search the Inventory for Every Known Tool
Search the software inventory of all endpoints for each remote access product, not only the ones you use. The CISA guide lists tools that attackers have used, among them ConnectWise Control (formerly ScreenConnect), AnyDesk, TeamViewer, Splashtop, Atera, and NetSupport. A tool on that list is not suspicious in itself. It needs an owner and a reason.
Compare the Results With the List
Three patterns deserve a closer look:
- A tool nobody approved. It stays a finding until someone can show who installed it and why.
- An approved tool in the wrong place. A support tool on a finance laptop or a server it was never meant to reach needs an explanation.
- More than one remote access tool on a single device. A move between support providers can leave two behind for good reasons. Investigate anyway, especially when no team owns the installations, because this is the pattern from the Huntress case.
Restrict and Repeat
Keep the approved tools updated, since the CISA guide asks organizations to prioritize patching for software that connects to the internet or accepts connections from it, including remote access agents. Remove standing local admin rights to block the installations that need elevation. Then repeat the search on a schedule: a tool that appears next month will not show up in this month’s review.
Know What the Inventory Cannot See
An inventory of installed software has a blind spot. The CISA guide warns that many remote access tools also run as portable executables, which launch without installation and often without admin rights, and some install for a single user without elevation. Portable tools never appear in a list of installed programs. The inventory gives IT a baseline across managed endpoints, not complete coverage, so combine it with application control, endpoint detection, and execution monitoring.
What to Do When You Find an Unapproved Remote Access Tool
Do not uninstall it first. If an attacker put it there, removing it destroys the evidence and warns the attacker that someone has noticed.
- Check for an owner. Ask whether a team, a supplier, or a service partner installed it for a documented reason. Many findings end here.
- Treat it as a possible incident if no one owns it. Escalate to the security team and follow the incident response procedure.
- Preserve the evidence and contain the access. Together with the security team, record what you know about the tool and the device, and cut the tool’s access in the way the procedure prescribes.
- Then remove it and watch for its return. Close the access path, and check in the next review that the tool has not come back.
Protect the Tools You Approved
Approved tools carry the same risk when someone steals the login. The CISA guide notes that attackers also obtain valid credentials for legitimate remote access software and use them directly. Every tool that can reach many endpoints at once, from the helpdesk’s remote access tool to the endpoint management platform itself, needs multifactor authentication and as few accounts as the work requires.
How CapaOne Shows Where Remote Access Tools Run
The CapaOne Endpoint Management Platform answers the inventory question across the fleet. In the Windows endpoint list, IT filters on an installed program and gets every device that has it, so one search per remote access tool shows where it runs. Save the search as a filter, and the same check is ready for the next review. Open any endpoint, and its software inventory shows the installed version, the detail that matters when an approved tool needs updating. Our post on endpoint application inventory covers how that inventory stays current, and asset management shows the wider picture.
Privilege Manager removes standing local admin rights, so installations that need elevation go through a request instead of happening on their own. Sign-in to CapaOne runs through Microsoft Entra ID, so the multifactor authentication and sign-in policies the organization already enforces apply to it as well.
CapaOne does not replace endpoint detection, and the CISA guide recommends monitoring with it. CapaOne shows the part of the answer that lives on the endpoints: which remote access tools run where. The approved list supplies the other part: who owns each one and why.
Run the first review on your own fleet: book a demo for a guided walk through the endpoint list, or start a free trial and search for the first remote access tool yourself.