LOTL - RMM Tool Covert C2 Tunneling from Server-Tier Assets

Ankit Mehta@Secvyn

•updated 10 days ago•5•0•1

Detects outbound network traffic from internal servers to known Remote Monitoring and Management (RMM) platforms (AnyDesk, ScreenConnect, Atera). This activity is often used by adversaries to establish covert command and control (C2) channels and remote access to internal resources.