Nightmare Eclipse - Legitimate RMM Spawning Recon Shells (T1059.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•7

Detects the initial intrusion vector where a compromised RMM agent (ScreenConnect, AnyDesk, TeamViewer) spawns a command shell to perform local network reconnaissance using commands like nltest, ping, ipconfig, whoami, or net group.