Chaos RaaS - RMM Tool Persistence from Suspicious Paths or Processes

Ibtissem Ouni@IbtissemOui

•updated Mar 10, 2026•23•2•229

Detects the execution of legitimate Remote Monitoring and Management (RMM) tools, such as AnyDesk, ScreenConnect, OptiTuneAgent, and SplashtopStreamer, when initiated from non-standard directories (outside 'C:\Program Files') or by command-line shells (powershell.exe, cmd.exe, wscript.exe, cscript.exe). This behavior is often abused by threat actors, including groups like Chaos RaaS, for persistence and remote access.