Detecting and Controlling MantisRMM in Your Environment

MantisRMM is a remote monitoring and management (RMM) product made by MantisOps, LLC. IT teams and managed service providers use it to manage computers they are responsible for, including remote desktop, a remote terminal and file transfer. Like every remote-access tool, it can be misused. This page gives you the facts you need to recognise the agent, decide whether it belongs on your computers, block it or allow it, and report misuse.

On this page: What the agent is · Files, services and signatures · Network endpoints · Blocking it · Allowing it · What the user sees · Removing the agent · Reporting abuse

What the agent is

One program, the MantisOps agent (mantis-agent), carries all MantisOps products: MantisRMM (remote management), Mantis360 (security posture) and MantisNMS (network monitoring). Which modules are active depends on what the owning account is licensed for. It runs as a system service on Windows, a launch daemon on macOS and a systemd service on Linux.

• Outbound only. The agent opens no listening ports. It connects out over HTTPS (TCP 443) to MantisOps servers and keeps one long-lived WebSocket open to receive work.
• Every device belongs to one account. A device is enrolled with an enrollment code tied to one MantisOps customer account. Only that account's users can see or reach it (and MantisOps support, only while the account has granted support access).
• Each device has its own key. After enrollment the server issues the device a secret key, stored in a folder only administrators can read; connections without it are refused.

Files, services and signatures

Windows

macOS

Linux

Network endpoints

All traffic is outbound TLS on TCP 443 unless noted.

Blocking api.rmm.mantisops.net stops all MantisRMM remote access: the agent can't enroll, receive jobs or start a remote session.

Installs usually start with one of these commands, which are worth alerting on if MantisRMM isn't used in your organisation:

Windows (PowerShell):
  iwr -UseBasicParsing 'https://api.rmm.mantisops.net/agent/unified/install/windows' | iex

macOS / Linux:
  curl -fsSL https://api.rmm.mantisops.net/agent/unified/install/unix | sudo TENANT=<code> bash

Blocking it

If MantisRMM has no business on your network, block it in layers:

• By publisher (recommended). In Microsoft Defender for Endpoint (certificate indicators), App Control for Business / WDAC, or AppLocker, deny files signed by MantisOps, LLC. This covers every current and future version. On macOS, block Team ID 7G5UR2WS94 with your MDM or endpoint-security tool.
• By domain. Block *.mantisops.net (at minimum api.rmm.mantisops.net and api.360.mantisops.net) at your DNS filter, secure web gateway or firewall.
• By hash. Hashes change with every release, so prefer the publisher rule. If you need hashes, compute them from the copy you found (for example Get-FileHash "C:\Program Files\MantisOps\mantis-agent.exe").
• By service or path. Alert on the creation of the MantisAgent service, C:\Program Files\MantisOps\, /Applications/MantisAgent.app or /usr/local/bin/mantis-agent.

Blocking is your decision and doesn't need our involvement. If you think the agent was installed on your computers without permission, please also report it so we can act on the account.

Allowing it

If your IT provider uses MantisRMM and your security tools flag it, allow it narrowly:

• Allow by publisher MantisOps, LLC (Windows) or Team ID 7G5UR2WS94 (macOS) rather than by path or hash.
• Allow outbound TCP 443 to api.rmm.mantisops.net (and api.360.mantisops.net if you use Mantis360), and exempt these hosts from TLS inspection; a broken WebSocket shows up as an agent that enrolls but stays offline.
• Confirm with your provider that the devices are enrolled into their MantisOps account: the account's console lists every enrolled device by name.

What the person at the computer sees

A remote session is never silent. These notices are sent by MantisOps' servers, not by the operator's browser, so no customer setting can turn them off and a modified client can't skip them:

• When an operator connects with remote desktop, a notification appears naming the operator and the organisation, for example: “Contoso IT support: Alice is connected to this computer remotely.” Each additional operator who joins is announced too.
• When the session ends, a second notification says who disconnected.
• When an operator opens a remote terminal (“… is running commands on this computer remotely”) or transfers files (“… is transferring files on this computer remotely”), a notification appears as well.
• On Windows (agent 2.0.201 and later), a small bar stays at the top centre of the screen for the whole remote-desktop session: “● Remote session in progress — <Operator> (<Organisation>)”. It never takes focus, and it is hidden from the operator's view of the screen so it doesn't get in their way. It disappears when the session ends or the agent stops.
• On macOS and Linux (agent 2.0.201 and later), the notifications appear as standard desktop notifications. The persistent bar is Windows-only for now.

The MantisOps agent has no system-tray icon; the notifications and the session bar are how it shows activity. Customers can change the wording, logo and colours, but not turn the notices off or remove the operator's name and organisation.

Removing the agent

From an administrator prompt on the computer:

Windows (elevated PowerShell):
  & "C:\Program Files\MantisOps\mantis-agent.exe" --uninstall

macOS:
  sudo /Applications/MantisAgent.app/Contents/MacOS/mantis-agent --uninstall

Linux:
  sudo /usr/local/bin/mantis-agent --uninstall

On Windows you can also use Settings → Apps → Installed apps → MantisOps Unified Agent → Uninstall. The uninstall removes the service, the program, its logs, and its configuration and device key. If you suspect the computer was accessed by someone you don't trust, also follow your normal incident-response steps (change passwords used on that computer, check for other remote-access tools).

Reporting abuse

On a confirmed report we can stop all remote jobs for the account, disable it across MantisOps products, end its users' sessions, and uninstall the agent from every device enrolled in it. To report a security vulnerability in MantisOps itself, email security@mantisops.net.