First Time Seen Commonly Abused Remote Access Tool Execution

  1[metadata]
  2creation_date = "2023/04/03"
  3integration = ["endpoint", "windows", "system"]
  4maturity = "production"
  5updated_date = "2025/03/20"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control
 11(C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects
 12when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type
 13indicating the host has not seen this RAT process started before within the last 30 days.
 14"""
 15from = "now-9m"
 16index = [
 17    "logs-endpoint.events.process-*",
 18    "endgame-*",
 19    "winlogbeat-*",
 20    "logs-windows.forwarded*",
 21    "logs-windows.sysmon_operational-*",
 22    "logs-system.security*",
 23]
 24language = "kuery"
 25license = "Elastic License v2"
 26name = "First Time Seen Commonly Abused Remote Access Tool Execution"
 27note = """## Triage and analysis
 28
 29### Investigating First Time Seen Commonly Abused Remote Access Tool Execution
 30
 31Remote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.
 32
 33At the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.
 34
 35This rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.
 36
 37#### Possible investigation steps
 38
 39- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 40- Check if the execution of the remote access tool is approved by the organization's IT department.
 41- Investigate other alerts associated with the user/host during the past 48 hours.
 42- Contact the account owner and confirm whether they are aware of this activity.
 43  - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
 44- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 45
 46### False positive analysis
 47
 48- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
 49
 50### Response and remediation
 51
 52- Initiate the incident response process based on the outcome of the triage.
 53- Isolate the involved host to prevent further post-compromise behavior.
 54- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 55- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 56- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.
 57- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
 58- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 59"""
 60references = [
 61    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
 62    "https://attack.mitre.org/techniques/T1219/",
 63    "https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json",
 64]
 65risk_score = 47
 66rule_id = "6e1a2cc4-d260-11ed-8829-f661ea17fbcc"
 67severity = "medium"
 68tags = [
 69    "Domain: Endpoint",
 70    "OS: Windows",
 71    "Use Case: Threat Detection",
 72    "Tactic: Command and Control",
 73    "Resources: Investigation Guide",
 74    "Data Source: Elastic Defend",
 75    "Data Source: Elastic Endgame",
 76    "Data Source: Windows Security Event Logs",
 77    "Data Source: Sysmon",
 78]
 79timestamp_override = "event.ingested"
 80type = "new_terms"
 81
 82query = '''
 83host.os.type: "windows" and
 84
 85   event.category: "process" and event.type : "start" and
 86
 87    (
 88        process.code_signature.subject_name : (
 89            "Action1 Corporation" or
 90            "AeroAdmin LLC" or
 91            "Ammyy LLC" or
 92            "Atera Networks Ltd" or
 93            "AWERAY PTE. LTD." or
 94            "BeamYourScreen GmbH" or
 95            "Bomgar Corporation" or
 96            "DUC FABULOUS CO.,LTD" or
 97            "DOMOTZ INC." or
 98            "DWSNET OÜ" or
 99            "FleetDeck Inc" or
100            "GlavSoft LLC" or
101            "GlavSoft LLC." or
102            "Hefei Pingbo Network Technology Co. Ltd" or
103            "IDrive, Inc." or
104            "IMPERO SOLUTIONS LIMITED" or
105            "Instant Housecall" or
106            "ISL Online Ltd." or
107            "LogMeIn, Inc." or
108            "Monitoring Client" or
109            "MMSOFT Design Ltd." or
110            "Nanosystems S.r.l." or
111            "NetSupport Ltd" or
112            "NinjaRMM, LLC" or
113            "Parallels International GmbH" or
114            "philandro Software GmbH" or
115            "Pro Softnet Corporation" or
116            "RealVNC" or
117            "RealVNC Limited" or
118            "BreakingSecurity.net" or
119            "Remote Utilities LLC" or
120            "Rocket Software, Inc." or
121            "SAFIB" or
122            "Servably, Inc." or
123            "ShowMyPC INC" or
124            "Splashtop Inc." or
125            "Superops Inc." or
126            "TeamViewer" or
127            "TeamViewer GmbH" or
128            "TeamViewer Germany GmbH" or
129            "Techinline Limited" or
130            "uvnc bvba" or
131            "Yakhnovets Denis Aleksandrovich IP" or
132            "Zhou Huabing"
133        ) or
134
135        process.name.caseless : (
136            AA_v*.exe or
137            "AeroAdmin.exe" or
138            "AnyDesk.exe" or
139            "apc_Admin.exe" or
140            "apc_host.exe" or
141            "AteraAgent.exe" or
142            aweray_remote*.exe or
143            "AweSun.exe" or
144            "B4-Service.exe" or
145            "BASupSrvc.exe" or
146            "bomgar-scc.exe" or
147            "domotzagent.exe" or
148            "domotz-windows-x64-10.exe" or
149            "dwagsvc.exe" or
150            "DWRCC.exe" or
151            "ImperoClientSVC.exe" or
152            "ImperoServerSVC.exe" or
153            "ISLLight.exe" or
154            "ISLLightClient.exe" or
155            fleetdeck_commander*.exe or
156            "getscreen.exe" or
157            "LMIIgnition.exe" or
158            "LogMeIn.exe" or
159            "ManageEngine_Remote_Access_Plus.exe" or
160            "Mikogo-Service.exe" or
161            "NinjaRMMAgent.exe" or
162            "NinjaRMMAgenPatcher.exe" or
163            "ninjarmm-cli.exe" or
164            "r_server.exe" or
165            "radmin.exe" or
166            "radmin3.exe" or
167            "RCClient.exe" or
168            "RCService.exe" or
169            "RemoteDesktopManager.exe" or
170            "RemotePC.exe" or
171            "RemotePCDesktop.exe" or
172            "RemotePCService.exe" or
173            "rfusclient.exe" or
174            "ROMServer.exe" or
175            "ROMViewer.exe" or
176            "RPCSuite.exe" or
177            "rserver3.exe" or
178            "rustdesk.exe" or
179            "rutserv.exe" or
180            "rutview.exe" or
181            "saazapsc.exe" or
182            ScreenConnect*.exe or
183            "smpcview.exe" or
184            "spclink.exe" or
185            "Splashtop-streamer.exe" or
186            "SRService.exe" or
187            "strwinclt.exe" or
188            "Supremo.exe" or
189            "SupremoService.exe" or
190            "teamviewer.exe" or
191            "TiClientCore.exe" or
192            "TSClient.exe" or
193            "tvn.exe" or
194            "tvnserver.exe" or
195            "tvnviewer.exe" or
196            UltraVNC*.exe or
197            UltraViewer*.exe or
198            "vncserver.exe" or
199            "vncviewer.exe" or
200            "winvnc.exe" or
201            "winwvc.exe" or
202            "Zaservice.exe" or
203            "ZohoURS.exe"
204        ) or
205        process.name : (
206            AA_v*.exe or
207            "AeroAdmin.exe" or
208            "AnyDesk.exe" or
209            "apc_Admin.exe" or
210            "apc_host.exe" or
211            "AteraAgent.exe" or
212            aweray_remote*.exe or
213            "AweSun.exe" or
214            "B4-Service.exe" or
215            "BASupSrvc.exe" or
216            "bomgar-scc.exe" or
217            "domotzagent.exe" or
218            "domotz-windows-x64-10.exe" or
219            "dwagsvc.exe" or
220            "DWRCC.exe" or
221            "ImperoClientSVC.exe" or
222            "ImperoServerSVC.exe" or
223            "ISLLight.exe" or
224            "ISLLightClient.exe" or
225            fleetdeck_commander*.exe or
226            "getscreen.exe" or
227            "LMIIgnition.exe" or
228            "LogMeIn.exe" or
229            "ManageEngine_Remote_Access_Plus.exe" or
230            "Mikogo-Service.exe" or
231            "NinjaRMMAgent.exe" or
232            "NinjaRMMAgenPatcher.exe" or
233            "ninjarmm-cli.exe" or
234            "r_server.exe" or
235            "radmin.exe" or
236            "radmin3.exe" or
237            "RCClient.exe" or
238            "RCService.exe" or
239            "RemoteDesktopManager.exe" or
240            "RemotePC.exe" or
241            "RemotePCDesktop.exe" or
242            "RemotePCService.exe" or
243            "rfusclient.exe" or
244            "ROMServer.exe" or
245            "ROMViewer.exe" or
246            "RPCSuite.exe" or
247            "rserver3.exe" or
248            "rustdesk.exe" or
249            "rutserv.exe" or
250            "rutview.exe" or
251            "saazapsc.exe" or
252            ScreenConnect*.exe or
253            "smpcview.exe" or
254            "spclink.exe" or
255            "Splashtop-streamer.exe" or
256            "SRService.exe" or
257            "strwinclt.exe" or
258            "Supremo.exe" or
259            "SupremoService.exe" or
260            "teamviewer.exe" or
261            "TiClientCore.exe" or
262            "TSClient.exe" or
263            "tvn.exe" or
264            "tvnserver.exe" or
265            "tvnviewer.exe" or
266            UltraVNC*.exe or
267            UltraViewer*.exe or
268            "vncserver.exe" or
269            "vncviewer.exe" or
270            "winvnc.exe" or
271            "winwvc.exe" or
272            "Zaservice.exe" or
273            "ZohoURS.exe"
274        )
275	) and
276
277	not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
278'''
279
280
281[[rule.threat]]
282framework = "MITRE ATT&CK"
283[[rule.threat.technique]]
284id = "T1219"
285name = "Remote Access Software"
286reference = "https://attack.mitre.org/techniques/T1219/"
287
288
289[rule.threat.tactic]
290id = "TA0011"
291name = "Command and Control"
292reference = "https://attack.mitre.org/tactics/TA0011/"
293
294[rule.new_terms]
295field = "new_terms_fields"
296value = ["host.id"]
297[[rule.new_terms.history_window_start]]
298field = "history_window_start"
299value = "now-15d"