Network & remote access
Remote access tools (RMM)
RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
- Location
- %ProgramData%\AnyDesk\ (and per-tool equivalents)
- Proves
- That a remote-access tool ran, with connection times, peer IDs and remote IP addresses
- Timestamps
- Log entries are per-tool text lines, usually local time (some UTC); file $SI times in NTFS UTC
- Retention
- Logs roll over by size or are overwritten on reinstall; portable runs leave logs only in the run folder
- Access
- Local admin or SYSTEM for %ProgramData% logs; user-scoped logs readable as that user
- Evidence of
- Network & remote accessPersistence
- Type
- File / file system
- Windows
- Vista / 78 / 8.11011
- KAPE target
- No dedicated target
- Velociraptor
- No dedicated target
Tools
Compare all toolsWhat it is
Remote monitoring and management (RMM) and remote-access tools such as AnyDesk, TeamViewer, ScreenConnect (ConnectWise Control), Splashtop, Atera and RustDesk are legitimate IT products that attackers routinely install for hands-on-keyboard access and persistence. Because they are signed, commercial software, they evade many controls and blend with normal admin activity. Each tool keeps its own connection logs, so they are a high-value source for reconstructing when a remote operator connected, from where, and what account they used.
Location
| Tool | Key files |
|---|---|
| AnyDesk | %ProgramData%\AnyDesk\ and %APPDATA%\AnyDesk\: ad.trace, ad_svc.trace, connection_trace.txt |
| TeamViewer | %APPDATA%\TeamViewer\ and Program Files: Connections_incoming.txt, TeamViewer<ver>_Logfile.log |
| ScreenConnect / ConnectWise Control | Client under %WINDIR%\Temp\ScreenConnect\ and a service; logs vary by build |
| Splashtop | %ProgramData%\Splashtop\Temp\log\ |
| Atera / AteraAgent | %ProgramFiles%\ATERA Networks\ plus a service |
| RustDesk | %APPDATA%\RustDesk\ (config and logs) |
File names and paths vary by version and installer, so treat the above as leads and confirm on the host. Installed tools usually register a Windows service and sometimes a scheduled task; enumerate both.
What it proves
- That the tool ran and accepted or made connections, with per-connection records.
- Peer identity and network origin: the remote AnyDesk/TeamViewer ID and, in several logs, the remote IP.
- It does not by itself prove the connection was malicious, nor identify the human operator; a peer ID or IP is an attribution lead to corroborate. Logs can also be truncated by rollover, so absence is not proof of no access.
Key fields
| Field | Meaning |
|---|---|
| Timestamp | Start/end of a session (check whether the tool logs local or UTC) |
| Peer / client ID | The connecting device's numeric ID |
| Direction | Incoming vs outgoing session |
| Remote IP | Present in some traces (for example AnyDesk ad.trace) |
| User / display name | Local account and, sometimes, the remote user label |
| File transfer | Some logs record transferred file names |
Timestamps
Most of these are plain-text logs with per-line timestamps. Verify the time base per tool: several log in local time, a few in UTC. Cross-check against the log file's NTFS $SI times and against event log entries so you anchor sessions to a known clock.
Retention and clearing
Logs roll over by size (older lines discarded) or are reset on reinstall, so long incidents may lose their earliest sessions. Portable ("run without install") execution leaves logs only in the folder the binary ran from, which attackers often delete. Recovery from the $MFT, USN journal and shadow copies is worthwhile.
Collection
Get-Service | Where-Object { $_.DisplayName -match 'AnyDesk|TeamViewer|ScreenConnect|Splashtop|Atera|RustDesk' }
robocopy $env:ProgramData\AnyDesk E:\case\AnyDesk /E /COPY:DAT
Copy-Item "$env:APPDATA\TeamViewer\Connections_incoming.txt" E:\case\
Also collect the services and scheduled tasks registry data and System event log (7045 service install) for install evidence.
Parsing tools
- Text tools (grep,
Select-String, an editor): the connection logs are plain text; grep for the incident IPs, dates and peer IDs. - EvtxECmd (Eric Zimmerman, free): parse the System log for 7045 (service installed) and the Application/product channels some tools write.
- RECmd / Registry Explorer: recover install and configuration keys and any Run-key persistence.
- KAPE: targets exist for common RMM tools; confirm the target name for your KAPE version before relying on it.
Investigation tips
- Build a quick inventory first: any RMM the organization does not officially use is immediately suspect. Attackers favor AnyDesk and ScreenConnect dropped mid-intrusion.
- Correlate the tool's session start with lateral movement and interactive logons (4624 type 10) and with process creation in the same minutes.
- AnyDesk
connection_trace.txtlists incoming session IDs and whether they were accepted;ad.tracecan contain the remote IP. TeamViewerConnections_incoming.txtgives peer ID, display name and start/stop times. - Check for service install (7045) or a scheduled task pointing at the RMM binary, and Run keys, to establish persistence and the install time.
- Look for the installer in
Downloads,%TEMP%or%ProgramData%, and pull its download zone identifier to source where it came from.
Related artifacts
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
- Scheduled TasksScheduled tasks cheat sheet: task XML and .job files, TaskCache registry keys, DynamicInfo times, hidden tasks, TaskScheduler and 4698 events.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- Network profiles (NetworkList)NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
Glossary terms
- Lateral movementAn attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
- PersistenceMechanisms that let malware or an attacker survive reboots and logoffs, such as Run keys, services, scheduled tasks or WMI subscriptions.
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
Guides
- Lateral Movement Forensics: RDP, PsExec, WMI and WinRMMap source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
- Hunting Windows Persistence: Registry, Tasks, WMI and MoreFind attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
- Remote Access Tool Forensics: AnyDesk, TeamViewer and MoreInvestigate abused RMM and remote access tools on Windows: install traces, per-tool logs, session IDs and IPs, file transfers and telling attackers from IT.