What is abuse of a remote-management platform?¶

Abuse of a remote-management platform is unauthorised use of legitimate administration software to issue commands, transfer files, deploy software or change systems remotely.

Because the platform and its endpoint agent are expected in the environment, their presence is not the important finding. The evidential question is who created a particular action, what it targeted and whether it was authorised.

Follow the action through the platform¶

A remote-management action may begin in a web console, through an API key or via a federated identity. The platform can then queue, schedule, retry or distribute the action long after the operator session ends. An endpoint event at 03:00 may therefore result from a job created hours earlier rather than a fresh login at 03:00.

Preserve, where available:

• tenant, operator, role and session identifiers;
• job, policy, script or command content;
• creation, approval, scheduling and execution times;
• target lists and per-target results; and
• endpoint process, file and network activity.

Cloud-hosted platforms may retain the decisive control-plane audit records outside the affected network. Native job and target identifiers provide the strongest bridge between those records and endpoint events.

Compare purpose as well as tooling¶

The same platform may support routine maintenance and an attack. Compare the disputed action with approved jobs, expected administrators, maintenance windows and usual targets. A trusted agent executing a valid platform job proves neither that the job was benign nor that the account holder personally created it.