How to Verify MSP Involvement in RMM and Endpoint Monitoring Incidents

Understanding the Challenge: Confirming MSP Role in RMM and Endpoint Incidents

Imagine you detect unusual activity on your network that points to remote monitoring and management (RMM) tools or endpoint monitoring systems. But was this caused by your internal team, or did the managed services provider (MSP) play a part? Pinpointing MSP involvement is crucial for accurate incident response and accountability.

This article provides actionable steps to verify MSP participation in such incidents, focusing on audit trails, log analysis, and change tracking.

Why MSP Involvement Happens in RMM and Endpoint Incidents

MSPs have privileged access to client systems through RMM tools, which allows them to perform maintenance, deploy patches, and monitor endpoints remotely. However, this access can also be exploited - intentionally or accidentally - leading to incidents such as unauthorized changes, data exposure, or malware outbreaks.

Common reasons for MSP involvement include:

Misconfigured RMM permissions: Excessive privileges lead to unintended system changes.
Compromised MSP credentials: Attackers use MSP access to pivot into client networks.
Insufficient monitoring of MSP activities: Lack of timely alerts on MSP actions.

For example, the 2021 Kaseya ransomware attack leveraged MSP RMM vulnerabilities, affecting thousands of endpoints downstream.

Do this now: Review your MSP contract and access agreement to understand the scope and limits of their RMM permissions.

Step 1: Use an RMM Audit Checklist to Start Your Investigation

Begin with a structured audit process tailored to RMM environments. A typical RMM audit checklist includes:

Audit Area	Key Checks	Tools/Logs to Review
User Access & Roles	Verify MSP user accounts and permissions	RMM user management logs
Remote Access Sessions	Confirm start/end times and IP addresses	Remote access session logs
Patch and Change History	Review deployment records and approvals	Patch management logs
Alerting & Incident Reports	Check for alerts triggered by MSP activity	IT monitoring system alert logs
Endpoint Monitoring Events	Look for unusual endpoint behavior	Endpoint management logs

Do this now: Download or create a comprehensive RMM audit checklist and begin collecting relevant logs from your RMM platform.

Step 2: Analyze Endpoint Management Logs for MSP Actions

Endpoint monitoring systems log detailed events, including software installs, configuration changes, and device status.

Look specifically for: - Timestamps matching MSP access periods - Commands or scripts executed remotely - Unusual or unauthorized changes

Tools like Microsoft Defender for Endpoint or SentinelOne provide detailed activity logs that can be filtered by user or service account.

Example: If MSP technician accounts appear running PowerShell scripts outside scheduled maintenance windows, this could indicate unauthorized access.

Do this now: Extract endpoint logs and correlate them with MSP user activity to identify potential involvement.

Step 3: Verify IT Monitoring System Access and Alerting Timeline

Reconstruct the incident timeline by reviewing IT monitoring system access logs and alert history.

Steps include: 1. Identify MSP login sessions: Check system access logs for MSP account activity. 2. Match alerts with MSP actions: Look for alerts triggered during or immediately after MSP sessions. 3. Cross-reference event timestamps: Align system events with MSP remote sessions.

For instance, tools like SolarWinds or Nagios track both user logins and alert generation, enabling precise timeline reconstruction.

Do this now: Compile logs from your monitoring system and map out the timeline of MSP access alongside security alerts.

Step 4: Confirm Patch Management and Change History with MSP Records

Patch deployment and configuration changes are common MSP tasks. Verify these actions by:

Reviewing patch management logs for who initiated and approved changes.
Comparing change management records from MSP reports with your internal logs.
Investigating any unauthorized or unplanned changes.

For example, a SolarWinds MSP patch management dashboard provides detailed audit trails showing technician ID, deployment time, and affected endpoints.

Do this now: Request detailed patch and change logs from your MSP and compare them against your system's records.

Step 5: Inspect Remote Access Session Logs for Attribution

Remote access session logs are critical for attribution. Focus on:

Session start and end times
IP addresses used by MSP personnel
Commands executed during sessions

Logging tools like BeyondTrust or TeamViewer maintain session recordings and command histories.

Example: A security analyst identified a breach by correlating a suspicious file exfiltration with an MSP remote session logged from an unexpected geographic location.

Do this now: Pull all remote session logs related to the incident timeframe and verify the legitimacy of MSP activities.

Preventing Future MSP-Related Incidents

To reduce risks associated with MSP involvement in RMM and endpoint management:

Enforce least privilege principles: Limit MSP permissions strictly to necessary functions.
Implement multi-factor authentication (MFA): Protect MSP accounts with strong authentication.
Enable session recording and monitoring: Capture all remote sessions for audit.
Automate alerting on unusual MSP activity: Use SIEM tools to flag anomalies.
Schedule regular audits: Periodically review MSP access and activities.

Do this now: Conduct a permissions review of MSP accounts and implement MFA if not already in place.

Frequently Asked Questions

What logs are most critical for verifying MSP involvement?

Endpoint management logs, remote access session logs, patch management records, and IT monitoring system alert logs are essential for comprehensive verification.

How can I differentiate between MSP legitimate activity and unauthorized actions?

Correlate timestamps, IP addresses, and user accounts with scheduled maintenance windows and approved change requests. Unscheduled or unexplained activities warrant deeper investigation.

What if MSP refuses to provide detailed logs?

Contractually insist on transparency and audit rights in your service agreements. Escalate concerns through legal or regulatory channels if necessary.

Are automated tools available to assist in this verification?

Yes. Platforms like Splunk, SolarWinds, and ManageEngine offer integrated log management and alert triage capabilities tailored for MSP environments.

How often should MSP-related audits be performed?

Quarterly audits are recommended, or immediately following any suspicious incident.

Summary

Verifying MSP involvement in RMM and endpoint monitoring incidents requires a multi-pronged approach:

Start with an RMM audit checklist to guide evidence collection.
Analyze endpoint and patch management logs for MSP activities.
Reconstruct alerting timelines from IT monitoring systems.
Examine remote access session logs for direct attribution.
Implement prevention measures to reduce future risks.

By following these steps, IT admins and security analysts can gain clear visibility into MSP actions, ensuring proper incident response and maintaining network security.

Do this now: Download your tailored RMM audit checklist and begin gathering MSP-related logs today to safeguard your infrastructure.