Hayabusa medium test sigma

Remote Access Tool Services Have Been Installed - Security

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4697,
    "ServiceName
| contains": [
      "AmmyyAdmin",
      "AnyDesk",
      "Atera",
      "BASupportExpressSrvcUpdater",
      "BASupportExpressStandaloneService",
      "chromoting",
      "GoToAssist",
      "GoToMyPC",
      "jumpcloud",
      "LMIGuardianSvc",
      "LogMeIn",
      "monblanking",
      "Parsec",
      "RManService",
      "RPCPerformanceService",
      "RPCService",
      "SplashtopRemoteService",
      "SSUService",
      "TeamViewer",
      "TightVNC",
      "vncserver",
      "Zoho"
    ]
  },
  "condition": "security and selection"
}

False Positives

⚠ The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out

Field Validations

Loading…

Comments (0)

Loading comments...