LOLRMM

LOLRMM (Living Off the Land RMM) is an open catalog of remote monitoring, management and remote access tools that attackers use to get into a network and stay there. For about 360 tools, such as AnyDesk, TeamViewer, ScreenConnect, RustDesk and Splashtop, it lists the install folders, executables, network domains and detection rules. Connect it, and Neo checks the software on your clients’ devices against it.

What Neo can do with LOLRMM

• Run a scheduled agent that lists each client’s devices with remote access tools you did not approve
• Note on a security ticket which remote access tools the device has installed
• Read a tool’s domains, install paths and executables when an alert names it

Neo reads each device’s installed software from your RMM, such as NinjaOne’s software inventory, and matches each program to the catalog by its name and by its install folder. Your own RMM and remote support tools are in the catalog too, so you tell the agent which tools you approve, and it counts those apart from the rest. A match is a lead to check, not proof of an attack: the technician decides whether the tool belongs there. The agent never removes or blocks a tool on its own. See LOLRMM API for the permission group.

Next steps