Rmm on Matt Swann — Detection Engineering & Threat Intel

Rmm on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/tags/rmm/Recent content in Rmm on Matt Swann — Detection Engineering & Threat IntelMatt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/og-image.pnghttp://mattswann.dev/og-image.pngHugoen-usFri, 10 Jul 2026 09:00:00 -0600Detecting Suspicious RMM Tool Execution Chains in Microsoft Defender (T1219)http://mattswann.dev/posts/suspicious-rmm-execution-chains/Fri, 10 Jul 2026 09:00:00 -0600http://mattswann.dev/posts/suspicious-rmm-execution-chains/One of the most common initial access vectors into environments by threat actors is through use of legitimate RMM tooling, offering both hands-on-keyboard access as well as stealth. Read more below for some considerations on detecting such activity.