The tools you trust most to run your Windows fleet are the same tools an attacker wants most. Remote monitoring and management (RMM) platforms, Group Policy Objects (GPO), and cloud mobile device management (MDM) through Microsoft Intune exist to reach every endpoint, run code with high privilege, and enforce configuration at scale. That is precisely why a threat actor who gains a foothold in any one of them inherits a pre-built distribution channel to the entire environment.

This is the uncomfortable inversion at the heart of modern endpoint management: the more capable your management plane, the larger your attack surface. A single compromised RMM console, one weaponized Group Policy, or a rogue Intune configuration profile can turn legitimate administrative machinery into the fastest lateral movement path in your network. Defenders who still picture intrusion as malware smuggled past antivirus are fighting the last war. Increasingly, the “malware” is signed, trusted, allow-listed software that IT deployed on purpose.

This article breaks down how RMM abuse, GPO abuse, and Intune abuse actually work, grounds the discussion in verified U.S. government guidance, and lays out a concrete plan for securing the management plane before it becomes the thing that betrays you.

Why the Management Plane Is the Prize

Every mature Windows environment concentrates enormous power into a handful of control systems. Domain controllers push Group Policy to thousands of machines. An RMM agent runs as SYSTEM on every workstation and server it touches. Intune reaches devices that never come near the corporate LAN. These systems are designed to be trusted, to run with high privilege, and to operate quietly in the background — the exact properties an attacker covets.

When a hacker compromises an ordinary user endpoint, they still have to work for privilege escalation and lateral movement. When they compromise the management plane, the work is already done. The management system is the lateral movement mechanism. It already has agents everywhere, it already runs as a privileged account, and its activity blends into the normal noise of IT operations. Detection tuned to catch “unusual” behavior often stays silent because pushing software and changing policy is exactly what these platforms are supposed to do.

That combination — reach, privilege, and legitimacy — is why defending management infrastructure deserves the same rigor you apply to your crown-jewel data.

RMM Abuse: Legitimate Remote Access as an Intrusion Tool

Remote monitoring and management software is the connective tissue of managed IT. Help desks use it to fix problems without a desk visit; managed service providers (MSPs) use it to administer hundreds of client environments. Tools like ScreenConnect (ConnectWise Control), AnyDesk, TeamViewer, Atera, and similar platforms grant remote control, file transfer, and command execution on demand. To an attacker, that is a full-featured remote access trojan that also happens to be code-signed, commonly allow-listed, and unlikely to trip endpoint defenses.

The verified case: CISA’s 2023 RMM advisory

On January 25, 2023, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) jointly published advisory AA23-025A, “Protecting Against Malicious Use of Remote Monitoring and Management Software.” The advisory documented a financially motivated phishing campaign, active since at least June 2022, that targeted federal civilian executive branch (FCEB) agencies.

The mechanics are worth studying because they are so mundane. Threat actors sent help-desk-themed phishing emails containing links. Recipients who clicked were steered to download legitimate RMM software — CISA specifically named ScreenConnect (now ConnectWise Control) and AnyDesk — delivered as portable executables rather than installed applications. Because the software was legitimate and self-contained, it often ran without administrative privileges and without triggering software-management controls. Once running, the actors used the RMM tool to conduct a refund scam, manipulating what victims saw on screen to trick them into sending money.

Two lessons generalize far beyond that specific scam. First, an attacker does not need custom malware when trusted remote access software will do the job — this is a living-off-the-land approach mapped in MITRE ATT&CK as T1219, Remote Access Tools. Second, portable RMM binaries neatly sidestep controls that assume software must be installed to run. The same tradecraft that enabled a refund fraud can enable initial access, persistence, and hands-on-keyboard lateral movement in any organization.

Why RMM compromise scales

RMM abuse is not limited to tricking one user into installing a tool. When an attacker breaches an RMM console — the management server itself, or an MSP’s tenant — the blast radius is every endpoint that console administers. Supply-chain-style incidents against MSPs have repeatedly shown how one compromised management platform can cascade into ransomware across dozens of downstream customers simultaneously. The RMM agent that pushes a legitimate patch to 5,000 machines can push a malicious payload to the same 5,000 machines just as efficiently. That is the definition of a high-value attack surface.

GPO Abuse: Turning Policy Into Persistence and Lateral Movement

Group Policy is the native configuration engine of Active Directory. A GPO can install software, run startup and logon scripts, schedule tasks, set registry values, adjust firewall rules, and manage local group membership across every machine in a domain or organizational unit. It is one of the most powerful tools an administrator has — and one of the most powerful an attacker can hijack.

How the abuse works, conceptually

An adversary who obtains rights to create or modify GPOs — typically after compromising a privileged account or reaching a domain controller — can weaponize policy itself. MITRE ATT&CK tracks this as T1484.001, Group Policy Modification, a sub-technique of Domain or Tenant Policy Modification. The appeal is that malicious changes ride the same trusted replication and enforcement channel as legitimate policy.

Common patterns, all described here at a defensive and conceptual level, include:

Policy-based persistence. Adding a malicious scheduled task or startup script to a widely linked GPO re-establishes attacker code on every affected machine at each policy refresh — even after individual endpoints are cleaned.
Privilege and access changes. Modifying “Restricted Groups” or local group membership settings to insert an attacker-controlled account into the local Administrators group across thousands of hosts at once.
Defense weakening. Using policy to disable security tooling, loosen firewall rules, or alter logging so that follow-on activity is quieter.
Mass code execution. Because GPO can deploy software and run scripts fleet-wide, a single malicious edit becomes an instant lateral movement and deployment mechanism — the domain equivalent of an RMM push.

The danger is subtlety. A new GPO or a small change to an existing one looks like routine administration. Without change monitoring on the policies themselves, a malicious edit can persist for weeks. This is why GPO abuse is a favored technique for both persistence and the “spread” phase that precedes domain-wide ransomware.

Intune and Cloud MDM Abuse: The New High-Value Control Plane

As organizations move to hybrid and cloud-first management, Microsoft Intune (part of Microsoft Intune / Endpoint Manager) has become a management plane every bit as powerful as on-premises Group Policy — and in some ways more so, because it reaches devices anywhere on the internet, not just those on the corporate network.

Intune can deploy applications, push PowerShell and shell scripts, enforce configuration profiles, run remediation scripts, and issue compliance policies to every enrolled device. Administrative control over Intune therefore carries the same essential risk profile as control over a domain: whoever holds it can run code, at scale, on managed endpoints.

Where the risk concentrates

The critical insight is that Intune abuse is fundamentally an identity and role problem. There is no on-premises server to breach; the control plane lives behind Microsoft Entra ID (formerly Azure AD) authentication. An attacker who compromises a highly privileged identity — a Global Administrator, an Intune Administrator, or a similar role — can use the legitimate Intune management experience to:

Deploy a malicious application or configuration profile to targeted device groups.
Push a PowerShell script that executes with high privilege on enrolled Windows endpoints.
Modify compliance and conditional access posture to weaken protections or maintain access.

MITRE ATT&CK captures the cloud dimension of this within T1484, Domain or Tenant Policy Modification, which explicitly includes modifying the policies of a cloud tenant to expand or maintain access. Because these actions are performed through the normal, authenticated admin surface, they can look indistinguishable from an administrator doing their job. The compromise of a single privileged account can convert Intune from a security asset into a fleet-wide payload delivery system — a breach amplified by the very design that makes cloud management efficient.

The common thread across all three

RMM, GPO, and Intune are different technologies, but the abuse pattern rhymes. In each case the attacker’s goal is to reach a trusted management system, borrow its legitimacy and privilege, and use its built-in reach to run code across many endpoints without deploying anything that obviously looks like an exploit. Defending against one and ignoring the others leaves an open door. The management plane must be treated as a single, unified attack surface.

Securing Your Management Plane

Locking down management infrastructure is achievable with disciplined, layered controls. The goal is not to weaken these tools — you need them — but to constrain who can wield them, what they can do, and how quickly you notice abuse. CISA’s guidance for defenders maps directly onto the following priorities.

1. Application control and RMM allow-listing

Start by deciding, deliberately, which remote access and management software is authorized in your environment — and block everything else. CISA’s advisory recommends auditing installed and running RMM tools, allow-listing only approved applications, and specifically watching for RMM software running as portable executables, which is a strong signal of unsanctioned use.

Deploy application control (for example, Windows Defender Application Control or AppLocker) to permit only sanctioned management agents to execute.
Maintain an explicit inventory of approved RMM products, and alert on the presence or execution of any others (AnyDesk, ScreenConnect, TeamViewer, and similar) that are not on the list.
Block unauthorized RMM connections at the network edge, and require that legitimate remote administration traverse approved, authenticated paths such as a VPN or a hardened jump host.
Treat portable-executable versions of remote access tools as suspicious by default.

2. GPO change monitoring and least privilege

Because GPO abuse hides inside normal administration, visibility into policy change is the single highest-value control.

Enable auditing for Group Policy creation, modification, and linking, and forward those events to a SIEM where changes can be reviewed and alerted on.
Baseline your GPOs and alert on any deviation — new scheduled tasks, startup scripts, Restricted Groups edits, or software-installation entries.
Rigorously restrict who can create and edit GPOs. Most administrators do not need this right; scope it tightly and review it regularly.
Protect Tier 0 assets (domain controllers, and the accounts that manage them) with privileged access workstations, strong multi-factor authentication (MFA), and just-in-time elevation so that the credentials needed to weaponize policy are hard to obtain in the first place.

3. Conditional access and identity hardening for Intune

Since cloud MDM abuse is an identity problem, the defense is identity-centric.

Enforce phishing-resistant MFA on all administrative roles, and apply Conditional Access policies that restrict privileged sign-ins to compliant devices, known locations, or privileged access workstations.
Apply least privilege to Entra ID and Intune roles. Minimize standing Global Administrators, and use Privileged Identity Management to grant time-bound, approval-gated, just-in-time access to Intune Administrator and similar roles.
Monitor and alert on high-impact Intune actions: new or modified device configuration profiles, script deployments, application assignments, and compliance-policy changes. Treat a script push to a broad device group as a security-relevant event, not just an operational one.
Review Conditional Access policies themselves for tampering — weakening these controls is a known move for maintaining access.

4. Detection, logging, and assume-breach discipline

Across all three planes, the unifying defensive theme is that abuse looks like administration, so you must instrument the administration.

Centralize logs from RMM consoles, domain controllers, and Intune/Entra ID, and correlate them. A code push, a new GPO, and an anomalous admin sign-in are far more telling together than in isolation.
Alert on management actions by time, source, and scale — for example, a fleet-wide deployment initiated outside a change window or from an unusual host.
Segment and protect the management systems themselves. Consoles, domain controllers, and admin portals belong on restricted networks with dedicated, monitored credentials.
Rehearse the response. If an RMM console, a GPO, or an Intune tenant were compromised tomorrow, you should already know how you would detect it, contain it, and evict the actor without leaving policy-based persistence behind.

Conclusion: Defend the Tools That Defend You

The evolution is clear. As endpoint defenses have improved at catching conventional malware, sophisticated threat actors have moved up the stack to the trusted systems that manage the endpoints. RMM software, Group Policy, and Intune are indispensable — and each one is a concentrated, high-privilege attack surface that can turn a single compromise into fleet-wide lateral movement. CISA, NSA, and MS-ISAC put the RMM version of this threat on the record in 2023; the same logic extends squarely to GPO and cloud MDM.

The organizations that stay ahead of this are the ones that stop treating management infrastructure as plumbing and start treating it as a crown jewel: allow-listed, least-privileged, closely monitored, and rehearsed against. Visibility into who can change policy, deploy code, and reach your fleet is no longer an operational nicety — it is a core security control.

Honeybadger Solutions LLC helps organizations find and close these gaps before an intruder does. If you want a clear-eyed assessment of your Windows management plane — an endpoint and fleet security review covering RMM governance, Group Policy hardening, and Intune and Conditional Access posture — or you need experienced digital forensics and incident response after a suspected compromise, our team is ready to help. Reach out to Honeybadger Solutions to start the conversation.

About Honeybadger Solutions

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering cybersecurity, digital forensics, and investigative services to clients nationwide. Whether you are dealing with a compromised device, a suspected intrusion, or you simply want to get ahead of these threats, our team can help.

What we do:

Digital forensics — mobile devices (iPhone, Android) and computers (Windows, macOS, Linux); intrusion reconstruction, evidence preservation, and expert-witness reporting
Cybersecurity & incident response — breach investigation, containment, malware and spyware analysis, and remediation
Penetration testing & security assessments — finding the gaps before an attacker does
Managed IT & endpoint security — hardening, monitoring, and patch management for small and mid-sized organizations
Private investigations — including TSCM / technical surveillance countermeasures (“bug sweeps”)
Executive & personal protection

📞 (602) 725-2818 · 🌐 honeybadgersolution.com · Veteran-Owned (SDVOSB) · Licensed & Insured

Concerned a device or network may already be compromised? Contact Honeybadger Solutions for a confidential consultation — we handle mobile and computer forensics, incident response, and everything above.

Related from the Honeybadger Windows computer-security series

Part of Honeybadger Solutions’ security-intelligence series. Explore the rest of the Windows coverage:

Sources

CISA, NSA, and MS-ISAC, “Protecting Against Malicious Use of Remote Monitoring and Management Software” (Advisory AA23-025A, January 25, 2023) — verifies the joint advisory, the phishing campaign against FCEB agencies, the naming of ScreenConnect (ConnectWise Control) and AnyDesk, the portable-executable technique, and the recommended RMM audit/allow-list mitigations. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
CISA and partners, “Guide to Securing Remote Access Software” (June 6, 2023) — supports defensive guidance on managing and monitoring remote access/RMM software and reducing its abuse. https://www.cisa.gov/news-events/alerts/2023/06/06/cisa-and-partners-release-joint-guide-securing-remote-access-software
CISA, “CISA Releases JCDC Remote Monitoring and Management (RMM) Cyber Defense Plan” (August 16, 2023) — supports the point that securing the RMM ecosystem is a recognized national defensive priority. https://www.cisa.gov/news-events/alerts/2023/08/16/cisa-releases-jcdc-remote-monitoring-and-management-rmm-cyber-defense-plan
MITRE ATT&CK, “Remote Access Tools” (T1219) — supports the framing of legitimate RMM/remote access software as an adversary technique. https://attack.mitre.org/techniques/T1219/
MITRE ATT&CK, “Domain or Tenant Policy Modification” (T1484) and “Group Policy Modification” (T1484.001) — supports the GPO abuse and cloud-tenant (Intune/Entra) policy modification framing. https://attack.mitre.org/techniques/T1484/ and https://attack.mitre.org/techniques/T1484/001/