How to Investigate a Security Alert for a New Remote Access Tool

A remote access tool may be installed for approved support or could provide an attacker with persistent control. The tool may not be managed by central endpoint policy.

What to check

Identify publisher, installer, account, service status, network connections, installation time, approval, and actions performed. Check whether the tool is authorized and whether unattended access is enabled.

Recommended next step

Contain unapproved access through incident procedures, preserve logs, and confirm whether credentials or files were accessed. For approved tools, enforce named accounts, session logging, and time limits.

How Informatix Systems can help

Informatix Systems provides security operations and endpoint incident response services. We can review the setup, identify likely causes, and help plan a practical resolution. Contact us with the platform involved, when the issue began, and non-sensitive error details.