Elastic medium stable kql
First Time Seen Remote Monitoring and Management Tool
Adversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This rule detects when a process is started whose name or code signature matches commonly abused RMM or remote access tools. New Terms type: the host.id and process.name pair has not been seen before within the configured 7-day history window.
Detection Logic
host.os.type: "windows" and
event.category: "process" and event.type: "start" and
(
process.code_signature.subject_name : (
"Action1 Corporation" or
"Aeroadmin LLC" or
"AeroAdmin LLC" or
"AmidaWare LLC" or
"Ammyy LLC" or
"AnyDesk Software GmbH" or
"AOMEI International Network Limited" or
"Atera Networks Ltd" or
"AWERAY PTE. LTD." or
"BeamYourScreen GmbH" or
"Bomgar Corporation" or
"BreakingSecurity.net" or
"ConnectWise, Inc." or
"ConnectWise, LLC" or
"Connectwise, LLC" or
"Devolutions Inc" or
"Devolutions inc." or
"DOMOTZ INC." or
"DUC FABULOUS CO.,LTD" or
"DWSNET OÜ" or
"DWSNET srl" or
"Electronic Team, Inc." or
"Famatech Corp." or
"FleetDeck Inc" or
"GlavSoft LLC" or
"GlavSoft LLC." or
"GoTo Technologies USA, LLC" or
"Hefei Pingbo Network Technology Co. Ltd" or
"IDrive, Inc." or
"Impero Solutions Limited" or
"IMPERO SOLUTIONS LIMITED" or
"Instant Housecall" or
"ISL Online Ltd." or
"JumpCloud Inc" or
"Level Software, Inc." or
"LogMeIn, Inc." or
"LUNIXAR SAS DE CV" or
"MMSOFT Design Ltd." or
"Monitoring Client" or
"MSPBytes Corp" or
"MSPBytes, Corp." or
"N-ABLE TECHNOLOGIES LTD" or
"Nanosystems S.r.l." or
"NetSupport Ltd" or
"NetSupport Ltd." or
"NETSUPPORT LTD." or
"NinjaOne LLC" or
"NinjaRMM, LLC" or
"Open Source Developer, Huabing Zhou" or
"Parallels International GmbH" or
"philandro Software GmbH" or
"Pro Softnet Corporation" or
"PURSLANE" or
"RealVNC" or
"RealVNC Limited" or
"REMOTE UTILITIES PTE. LTD." or
"Remote Utilities LLC" or
"Rocket Software, Inc." or
"Rsupport Co., Ltd." or
"SAFIB" or
"ScreenConnect Client" or
"Servably, Inc." or
"Servably Inc." or
"ShowMyPC INC" or
"SimpleHelp Ltd" or
"Splashtop Inc." or
"Superops Inc." or
"Tailscale Inc." or
"TeamViewer" or
"TeamViewer GmbH" or
"TeamViewer Germany GmbH" or
"Techinline Limited" or
"uvnc bvba" or
"Yakhnovets Denis Aleksandrovich IP" or
"Zhou Huabing" or
"ZOHO Corporation Private Limited"
) or
process.name.caseless : (
AA_v*.exe or
"AcronisCyberProtectConnectAgent.exe" or
"AeroAdmin.exe" or
"AgentMon.exe" or
"AnyDesk.exe" or
"apc_Admin.exe" or
"apc_host.exe" or
"AteraAgent.exe" or
aweray_remote*.exe or
"AweSun.exe" or
"B4-Service.exe" or
"BASupSrvc.exe" or
"bomgar-scc.exe" or
"CagService.exe" or
"CloudRaCmd.exe" or
"CloudRaSd.exe" or
"CloudRaService.exe" or
ConnectWiseControl*.exe or
"connectwisecontrol.client.exe" or
"domotzagent.exe" or
"domotz-windows-x64-10.exe" or
"dwagsvc.exe" or
"DWRCC.exe" or
"dwrcs.exe" or
"dwrcst.exe" or
fleetdeck_commander*.exe or
"g2aservice.exe" or
"getscreen.exe" or
"GoToAssistService.exe" or
"GoToResolveProcessChecker.exe" or
"GoToResolveRemoteControl.exe" or
"GoToResolveService.exe" or
"GoToResolveTerminal.exe" or
"GoToResolveUnattended.exe" or
"gotohttp.exe" or
"helpwire.exe" or
"ImmyAgent.exe" or
"ImmyBot.Agent.Ephemeral.exe" or
"ImmyUpdater.exe" or
"ImperoClientSVC.exe" or
"ImperoServerSVC.exe" or
"ISLLight.exe" or
"ISLLightClient.exe" or
"jumpcloud-agent.exe" or
"komari.exe" or
"komari-agent.exe" or
"level.exe" or
"lmi_rescue.exe" or
"lmi_rescue_srv.exe" or
"LMIIgnition.exe" or
"LogMeIn.exe" or
"ltsvc.exe" or
"ltsvcmon.exe" or
"lttray.exe" or
"Lunixar.exe" or
"LunixarRemote.exe" or
"LunixarUpdater.exe" or
"LvAgent.exe" or
"ManageEngine_Remote_Access_Plus.exe" or
"MeshAgent.exe" or
"Mikogo-Service.exe" or
"nezha-agent.exe" or
"NinjaRMMAgent.exe" or
"NinjaRMMAgentPatcher.exe" or
"ninjarmm-cli.exe" or
"parsec.exe" or
"PService.exe" or
"quickassist.exe" or
"r_server.exe" or
"radmin.exe" or
"radmin3.exe" or
"rcengmgru.exe" or
"RCClient.exe" or
"rcmgrsvc.exe" or
"RCService.exe" or
"Remote Support.exe" or
"RemoteDesktopManager.exe" or
"Remotely_Agent.exe" or
"Remotely_Desktop.exe" or
"RemotePC.exe" or
"RemotePCDesktop.exe" or
"RemotePCService.exe" or
"remoteview.exe" or
"rfusclient.exe" or
"RMM.Agent.exe" or
"ROMServer.exe" or
"ROMViewer.exe" or
"RPCSuite.exe" or
"rserver3.exe" or
"rustdesk.exe" or
"rutserv.exe" or
"rutview.exe" or
"rvagent.exe" or
"rvagtray.exe" or
"saazapsc.exe" or
ScreenConnect*.exe or
"ScreenConnect.ClientService.exe" or
"session_win.exe" or
"simplegatewayservice.exe" or
"simplehelpcustomer.exe" or
"smpcview.exe" or
"spclink.exe" or
"Splashtop-streamer.exe" or
"SplashtopSOS.exe" or
"spsrv.exe" or
"sragent.exe" or
"SRService.exe" or
"srmanager.exe" or
"srserver.exe" or
"strwinclt.exe" or
"Supremo.exe" or
"SupremoService.exe" or
"Syncro.App.Runner.exe" or
"Syncro.Installer.exe" or
"Syncro.Overmind.Service.exe" or
"Syncro.Service.exe" or
"SyncroLive.Agent.exe" or
"SyncroLive.Agent.Runner.exe" or
"SyncroLive.Service.exe" or
"tacticalrmm.exe" or
"tailscale.exe" or
"tailscaled.exe" or
"teamviewer.exe" or
"teamviewer_desktop.exe" or
"teamviewer_service.exe" or
"TiAgent.exe" or
"TiClientCore.exe" or
"ToDesk_Service.exe" or
"ToolsIQ.exe" or
"TSClient.exe" or
"tvn.exe" or
"tvnserver.exe" or
"tvnviewer.exe" or
"twingate.exe" or
UltraVNC*.exe or
UltraViewer*.exe or
"Velociraptor.exe" or
"vncserver.exe" or
"vncviewer.exe" or
"winvnc.exe" or
"winwvc.exe" or
"ZA_Access.exe" or
"za_connect.exe" or
"Zaservice.exe" or
"ZMAgent.exe" or
"ZohoMeeting.exe" or
"zohotray.exe" or
"ZohoURS.exe" or
"ZohoURSService.exe"
)
) and
not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")Field Validations
Loading…
Comments (0)
Loading comments...