Sigma medium test sigma

Remote Access Tool Services Have Been Installed - System

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

View Source

Detection Logic

{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": [
      7045,
      7036
    ],
    "ServiceName
| contains": [
      "AmmyyAdmin",
      "Atera",
      "BASupportExpressSrvcUpdater",
      "BASupportExpressStandaloneService",
      "chromoting",
      "GoToAssist",
      "GoToMyPC",
      "jumpcloud",
      "LMIGuardianSvc",
      "LogMeIn",
      "monblanking",
      "Parsec",
      "RManService",
      "RPCPerformanceService",
      "RPCService",
      "SplashtopRemoteService",
      "SSUService",
      "TeamViewer",
      "TightVNC",
      "vncserver",
      "Zoho"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...