How do we find remote-desktop apps installed without permission?
Use three sources: the software inventory, the network traffic and DNS. Your endpoint management or antivirus console can usually list installed programs; search it for remote-desktop and remote-support tools. On the network, these apps keep a steady connection to their vendor's relay servers even when nobody is using them, so a PC that contacts the same outside service every few minutes, day and night, is worth checking. Your DNS or firewall logs show the vendor domains they look up. Once found, decide case by case: remove the tool, or replace it with the approved one. Prevent repeats by removing local administrator rights and allow-listing software. NetSenX flags the regular check-ins as beaconing, on every plan, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor or from the agent on that host, and when the agent runs on the computer, the alert names the program. It does not keep a software inventory; your endpoint tools do.
Read next
Related questions
- What is a bastion host or remote-desktop gateway, and do we need one?
- Is leaving SSH open to the internet bad practice even with Fail2ban?
- Does moving SSH to a non-standard port help?
- How do I know if someone is brute-forcing our SSH servers right now?
- Are we affected by OpenSSH flaws such as regreSSHion?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
← All 40 questions on Remote work and exposed servicesAll topics