Multiple Remote Management Tool Vendors on Same Host

  1[metadata]
  2creation_date = "2026/03/23"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/06/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a Windows host where two or more distinct remote monitoring and management (RMM) or remote-access tool
 11vendors are observed starting processes within the same eight-minute window. Legitimate MSP environments may run
 12multiple tools, but this pattern can also indicate compromise, shadow IT, or attacker staging of redundant access.
 13Processes are mapped to a single vendor label so multiple binaries from the same vendor do not inflate the count.
 14"""
 15from = "now-9m"
 16interval = "8m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "Multiple Remote Management Tool Vendors on Same Host"
 20note = """## Triage and analysis
 21
 22### Investigating Multiple Remote Management Tool Vendors on Same Host
 23
 24This rule aggregates process start events by `host.id` and host name within the rule's nine-minute lookback window. Data can come from Elastic Defend, Sysmon, Winlogbeat, Windows Security / forwarded events, Microsoft Defender XDR, SentinelOne, or CrowdStrike FDR—where ECS process fields are populated. Each known RMM-related process name maps to one **vendor** label (e.g. TeamViewer, AnyDesk, ScreenConnect). If **two or more different vendor labels** appear within the same lookback window, the rule signals.
 25
 26### Possible investigation steps
 27
 28- Open **Esql.vendors_seen** and **Esql.processes_executable_values** on the alert to see which tools fired in the window.
 29- Confirm whether the host is an MSP-managed jump box, helpdesk workstation, or lab where multiple RMM stacks are expected.
 30- For servers or standard user endpoints, treat as higher risk: review install source, code signatures, and recent logons.
 31- Correlate with other alerts (ingress tool transfer, suspicious scripting, new persistence) on the same `host.id`.
 32- Check asset inventory and change tickets for approved RMM software.
 33
 34### False positive analysis
 35
 36- **MSP / IT tooling**: A technician machine with two approved agents (e.g. RMM + remote support) may match. Tune with host or organizational unit exceptions, or raise the vendor threshold if your environment standardizes on a known pair.
 37- **Vendor rebrands or bundles**: Rare overlaps during migrations can briefly show two vendors; validate timeline and packages.
 38
 39### Response and remediation
 40
 41- If unauthorized or unexplained: isolate the host, inventory installed remote-access software, remove unapproved tools, and reset credentials that may have been exposed. Enforce a single approved RMM stack per asset class where possible.
 42"""
 43
 44setup = """## Setup
 45
 46This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 47
 48Setup instructions: https://ela.st/install-elastic-defend
 49
 50### Additional data sources
 51
 52This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 53
 54- [CrowdStrike](https://ela.st/crowdstrike-integration)
 55- [Microsoft Defender XDR](https://ela.st/m365-defender)
 56- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 57- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 58- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
 59"""
 60
 61references = [
 62    "https://attack.mitre.org/techniques/T1219/",
 63    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a",
 64    "https://lolrmm.io/",
 65]
 66risk_score = 47
 67rule_id = "c3f8a1d2-4b5e-4c6f-9a8b-1e2d3f4a5b6c"
 68severity = "medium"
 69tags = [
 70    "Domain: Endpoint",
 71    "OS: Windows",
 72    "Use Case: Threat Detection",
 73    "Tactic: Command and Control",
 74    "Resources: Investigation Guide",
 75    "Data Source: Elastic Defend",
 76    "Data Source: Sysmon",
 77    "Data Source: SentinelOne",
 78    "Data Source: Microsoft Defender XDR",
 79    "Data Source: Crowdstrike",
 80    "Data Source: Windows Security Event Logs",
 81    "Data Source: Winlogbeat",
 82]
 83timestamp_override = "event.ingested"
 84type = "esql"
 85
 86query = '''
 87from logs-endpoint.events.process-*, logs-crowdstrike.fdr*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*, logs-system.security*, logs-windows.sysmon_operational-*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index
 88| where (host.os.type == "windows" or host.os.family == "windows")
 89    and event.category == "process"
 90    and event.type == "start"
 91    and process.name is not null
 92| eval Esql.rmm_vendor = case(
 93    process.name.caseless like "aa_v*.exe", "AnyAssist",
 94    process.name.caseless == "acroniscyberprotectconnectagent.exe", "Acronis",
 95    process.name.caseless == "aeroadmin.exe", "AeroAdmin",
 96    process.name.caseless == "agentmon.exe", "ConnectWiseAutomate",
 97    process.name.caseless == "anydesk.exe", "AnyDesk",
 98    process.name.caseless == "apc_admin.exe", "APC",
 99    process.name.caseless == "apc_host.exe", "APC",
100    process.name.caseless == "ateraagent.exe", "Atera",
101    process.name.caseless like "aweray_remote*.exe", "AweSun",
102    process.name.caseless == "awesun.exe", "AweSun",
103    process.name.caseless == "b4-service.exe", "BeyondTrust",
104    process.name.caseless == "basupsrvc.exe", "BeyondTrust",
105    process.name.caseless == "bomgar-scc.exe", "BeyondTrust",
106    process.name.caseless == "remote support.exe", "BeyondTrust",
107    process.name.caseless == "cagservice.exe", "BarracudaRMM",
108    process.name.caseless == "cloudracmd.exe", "CloudRadial",
109    process.name.caseless == "cloudrasd.exe", "CloudRadial",
110    process.name.caseless == "cloudraservice.exe", "CloudRadial",
111    process.name.caseless like "connectwisecontrol*.exe", "ScreenConnect",
112    process.name.caseless == "domotzagent.exe", "Domotz",
113    process.name.caseless == "domotz-windows-x64-10.exe", "Domotz",
114    process.name.caseless == "dwagsvc.exe", "DWService",
115    process.name.caseless == "dwrcc.exe", "DWService",
116    process.name.caseless == "dwrcs.exe", "DWService",
117    process.name.caseless == "dwrcst.exe", "DWService",
118    process.name.caseless like "fleetdeck_commander*.exe", "FleetDeck",
119    process.name.caseless == "g2aservice.exe", "GoTo",
120    process.name.caseless == "getscreen.exe", "GetScreen",
121    process.name.caseless == "gotoassistservice.exe", "GoTo",
122    process.name.caseless == "gotohttp.exe", "GoTo",
123    process.name.caseless == "gotoresolveprocesschecker.exe", "GoTo",
124    process.name.caseless == "gotoresolveremotecontrol.exe", "GoTo",
125    process.name.caseless == "gotoresolveservice.exe", "GoTo",
126    process.name.caseless == "gotoresolveterminal.exe", "GoTo",
127    process.name.caseless == "gotoresolveunattended.exe", "GoTo",
128    process.name.caseless == "helpwire.exe", "HelpWire",
129    process.name.caseless == "immyagent.exe", "ImmyBot",
130    process.name.caseless == "immybot.agent.ephemeral.exe", "ImmyBot",
131    process.name.caseless == "immyupdater.exe", "ImmyBot",
132    process.name.caseless == "imperoclientsvc.exe", "Impero",
133    process.name.caseless == "imperoserversvc.exe", "Impero",
134    process.name.caseless == "isllight.exe", "ISLOnline",
135    process.name.caseless == "isllightclient.exe", "ISLOnline",
136    process.name.caseless == "jumpcloud-agent.exe", "JumpCloud",
137    process.name.caseless == "komari.exe", "Komari",
138    process.name.caseless == "komari-agent.exe", "Komari",
139    process.name.caseless == "level.exe", "Level",
140    process.name.caseless == "lmi_rescue.exe", "LogMeIn",
141    process.name.caseless == "lmi_rescue_srv.exe", "LogMeIn",
142    process.name.caseless == "lmiignition.exe", "LogMeIn",
143    process.name.caseless == "logmein.exe", "LogMeIn",
144    process.name.caseless == "ltsvc.exe", "ConnectWiseAutomate",
145    process.name.caseless == "ltsvcmon.exe", "ConnectWiseAutomate",
146    process.name.caseless == "lttray.exe", "ConnectWiseAutomate",
147    process.name.caseless == "lunixar.exe", "Lunixar",
148    process.name.caseless == "lunixarremote.exe", "Lunixar",
149    process.name.caseless == "lunixarupdater.exe", "Lunixar",
150    process.name.caseless == "lvagent.exe", "Level",
151    process.name.caseless == "manageengine_remote_access_plus.exe", "ManageEngine",
152    process.name.caseless == "meshagent.exe", "MeshCentral",
153    process.name.caseless == "mikogo-service.exe", "Mikogo",
154    process.name.caseless == "nezha-agent.exe", "Nezha",
155    process.name.caseless == "ninjarmmagent.exe", "NinjaOne",
156    process.name.caseless == "ninjarmmagentpatcher.exe", "NinjaOne",
157    process.name.caseless == "ninjarmm-cli.exe", "NinjaOne",
158    process.name.caseless == "parsec.exe", "Parsec",
159    process.name.caseless == "pservice.exe", "Pulseway",
160    process.name.caseless == "quickassist.exe", "QuickAssist",
161    process.name.caseless == "r_server.exe", "Radmin",
162    process.name.caseless == "radmin.exe", "Radmin",
163    process.name.caseless == "radmin3.exe", "Radmin",
164    process.name.caseless == "rcengmgru.exe", "Rsupport",
165    process.name.caseless == "rcclient.exe", "RPCSuite",
166    process.name.caseless == "rcmgrsvc.exe", "Rsupport",
167    process.name.caseless == "rcservice.exe", "RPCSuite",
168    process.name.caseless == "remotedesktopmanager.exe", "Devolutions",
169    process.name.caseless == "remotely_agent.exe", "Remotely",
170    process.name.caseless == "remotely_desktop.exe", "Remotely",
171    process.name.caseless == "remotepc.exe", "RemotePC",
172    process.name.caseless == "remotepcdesktop.exe", "RemotePC",
173    process.name.caseless == "remotepcservice.exe", "RemotePC",
174    process.name.caseless == "remoteview.exe", "Rsupport",
175    process.name.caseless == "rfusclient.exe", "RemoteUtilities",
176    process.name.caseless == "rmm.agent.exe", "SuperOps",
177    process.name.caseless == "romserver.exe", "RealVNC",
178    process.name.caseless == "romviewer.exe", "RealVNC",
179    process.name.caseless == "rpcsuite.exe", "RPCSuite",
180    process.name.caseless == "rserver3.exe", "Radmin",
181    process.name.caseless == "rustdesk.exe", "RustDesk",
182    process.name.caseless == "rutserv.exe", "RemoteUtilities",
183    process.name.caseless == "rutview.exe", "RemoteUtilities",
184    process.name.caseless == "rvagent.exe", "Rsupport",
185    process.name.caseless == "rvagtray.exe", "Rsupport",
186    process.name.caseless == "saazapsc.exe", "Kaseya",
187    process.name.caseless like "screenconnect*.exe", "ScreenConnect",
188    process.name.caseless == "session_win.exe", "ZohoAssist",
189    process.name.caseless == "simplegatewayservice.exe", "SimpleHelp",
190    process.name.caseless == "simplehelpcustomer.exe", "SimpleHelp",
191    process.name.caseless == "smpcview.exe", "Splashtop",
192    process.name.caseless == "spclink.exe", "Splashtop",
193    process.name.caseless == "splashtop-streamer.exe", "Splashtop",
194    process.name.caseless == "splashtopsos.exe", "Splashtop",
195    process.name.caseless == "spsrv.exe", "Splashtop",
196    process.name.caseless == "sragent.exe", "Splashtop",
197    process.name.caseless == "srservice.exe", "Splashtop",
198    process.name.caseless == "srmanager.exe", "Splashtop",
199    process.name.caseless == "srserver.exe", "Splashtop",
200    process.name.caseless == "strwinclt.exe", "Splashtop",
201    process.name.caseless == "supremo.exe", "Supremo",
202    process.name.caseless == "supremoservice.exe", "Supremo",
203    process.name.caseless == "syncro.app.runner.exe", "Splashtop",
204    process.name.caseless == "syncro.installer.exe", "Splashtop",
205    process.name.caseless == "syncro.overmind.service.exe", "Splashtop",
206    process.name.caseless == "syncro.service.exe", "Splashtop",
207    process.name.caseless == "syncrolive.agent.exe", "Splashtop",
208    process.name.caseless == "syncrolive.agent.runner.exe", "Splashtop",
209    process.name.caseless == "syncrolive.service.exe", "Splashtop",
210    process.name.caseless == "tacticalrmm.exe", "TacticalRMM",
211    process.name.caseless == "tailscale.exe", "Tailscale",
212    process.name.caseless == "tailscaled.exe", "Tailscale",
213    process.name.caseless == "teamviewer.exe", "TeamViewer",
214    process.name.caseless == "teamviewer_desktop.exe", "TeamViewer",
215    process.name.caseless == "teamviewer_service.exe", "TeamViewer",
216    process.name.caseless == "tiagent.exe", "Tiflux",
217    process.name.caseless == "ticlientcore.exe", "Tiflux",
218    process.name.caseless == "todesk_service.exe", "ToDesk",
219    process.name.caseless == "toolsiq.exe", "ToolsIQ",
220    process.name.caseless == "tsclient.exe", "Techinline",
221    process.name.caseless == "tvn.exe", "TightVNC",
222    process.name.caseless == "tvnserver.exe", "TightVNC",
223    process.name.caseless == "tvnviewer.exe", "TightVNC",
224    process.name.caseless == "twingate.exe", "Twingate",
225    process.name.caseless like "ultravnc*.exe", "UltraVNC",
226    process.name.caseless like "ultraviewer*.exe", "UltraViewer",
227    process.name.caseless == "velociraptor.exe", "Velociraptor",
228    process.name.caseless == "vncserver.exe", "RealVNC",
229    process.name.caseless == "vncviewer.exe", "RealVNC",
230    process.name.caseless == "winvnc.exe", "RealVNC",
231    process.name.caseless == "winwvc.exe", "TightVNC",
232    process.name.caseless == "za_access.exe", "ZohoAssist",
233    process.name.caseless == "za_connect.exe", "ZohoAssist",
234    process.name.caseless == "zaservice.exe", "ZohoAssist",
235    process.name.caseless == "zmagent.exe", "ZohoAssist",
236    process.name.caseless == "zohomeeting.exe", "ZohoAssist",
237    process.name.caseless == "zohotray.exe", "ZohoAssist",
238    process.name.caseless == "zohours.exe", "ZohoAssist",
239    process.name.caseless == "zohoursservice.exe", "ZohoAssist",
240    ""
241  )
242| where Esql.rmm_vendor != "" and Esql.rmm_vendor is not NULL
243| stats Esql.vendor_count = count_distinct(Esql.rmm_vendor),
244        Esql.vendors_seen = values(Esql.rmm_vendor),
245        Esql.processes_executable_values = values(process.executable),
246        Esql.first_seen = min(@timestamp),
247        Esql.last_seen = max(@timestamp)
248  by host.name, host.id
249| where Esql.vendor_count >= 2
250| sort Esql.vendor_count desc
251| keep host.id, host.name, Esql.*
252'''
253
254[[rule.threat]]
255framework = "MITRE ATT&CK"
256
257[[rule.threat.technique]]
258id = "T1219"
259name = "Remote Access Tools"
260reference = "https://attack.mitre.org/techniques/T1219/"
261
262[[rule.threat.technique.subtechnique]]
263id = "T1219.002"
264name = "Remote Desktop Software"
265reference = "https://attack.mitre.org/techniques/T1219/002/"
266
267[rule.threat.tactic]
268id = "TA0011"
269name = "Command and Control"
270reference = "https://attack.mitre.org/tactics/TA0011/"