First Time Seen Remote Monitoring and Management Tool

  1[metadata]
  2creation_date = "2023/04/03"
  3integration = ["endpoint", "windows", "system"]
  4maturity = "production"
  5updated_date = "2026/05/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Adversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This rule detects when a process is started whose name or code signature (or whose parent's name or code signature) resembles commonly abused RMM/remote access tools, including first-time-seen child processes of such tools. New Terms type: host has not seen this process (or child-of-RMM pattern) before within the configured history window.
 11"""
 12from = "now-9m"
 13index = [
 14    "logs-endpoint.events.process-*",
 15    "endgame-*",
 16    "winlogbeat-*",
 17    "logs-windows.forwarded*",
 18    "logs-windows.sysmon_operational-*",
 19    "logs-system.security*",
 20]
 21language = "kuery"
 22license = "Elastic License v2"
 23name = "First Time Seen Remote Monitoring and Management Tool"
 24note = """## Triage and analysis
 25
 26### Investigating First Time Seen Remote Monitoring and Management Tool
 27
 28Remote monitoring and management (RMM) and remote access software are commonly used by IT departments to provide support and manage endpoints. Attackers adopt the same tools to connect into interactive sessions, maintain access as a persistence mechanism, and drop malicious software.
 29
 30This rule detects when an RMM or remote access process is seen on a host for the first time within the new_terms history window (see rule.new_terms), enabling analysts to investigate and enforce the correct usage of such tools.
 31
 32#### Possible investigation steps
 33
 34- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 35- Check if the execution of the RMM or remote access tool is approved by the organization's IT department.
 36- Investigate other alerts associated with the user/host during the past 48 hours.
 37- Contact the account owner and confirm whether they are aware of this activity.
 38  - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
 39- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 40
 41### False positive analysis
 42
 43- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
 44
 45### Response and remediation
 46
 47- Initiate the incident response process based on the outcome of the triage.
 48- Isolate the involved host to prevent further post-compromise behavior.
 49- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 50- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 51- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.
 52- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
 53- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 54"""
 55references = [
 56    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
 57    "https://attack.mitre.org/techniques/T1219/002/",
 58    "https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json",
 59    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a", "https://www.cisa.gov/sites/default/files/2025-06/aa25-163a-ransomware-simplehelp-rmm-compromise.pdf",
 60]
 61risk_score = 47
 62rule_id = "6e1a2cc4-d260-11ed-8829-f661ea17fbcc"
 63severity = "medium"
 64tags = [
 65    "Domain: Endpoint",
 66    "OS: Windows",
 67    "Use Case: Threat Detection",
 68    "Tactic: Command and Control",
 69    "Resources: Investigation Guide",
 70    "Data Source: Elastic Defend",
 71    "Data Source: Elastic Endgame",
 72    "Data Source: Windows Security Event Logs",
 73    "Data Source: Sysmon",
 74]
 75timestamp_override = "event.ingested"
 76type = "new_terms"
 77setup = """## Setup
 78
 79This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 80
 81Setup instructions: https://ela.st/install-elastic-defend
 82
 83### Additional data sources
 84
 85This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 86
 87- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 88- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
 89"""
 90
 91query = '''
 92host.os.type: "windows" and
 93
 94   event.category: "process" and event.type: "start" and
 95
 96    (
 97        process.code_signature.subject_name : (
 98            "Action1 Corporation" or
 99            "AeroAdmin LLC" or
100            "Ammyy LLC" or
101            "Atera Networks Ltd" or
102            "AWERAY PTE. LTD." or
103            "BeamYourScreen GmbH" or
104            "Bomgar Corporation" or
105            "DUC FABULOUS CO.,LTD" or
106            "DOMOTZ INC." or
107            "DWSNET OÜ" or
108            "FleetDeck Inc" or
109            "GlavSoft LLC" or
110            "GlavSoft LLC." or
111            "Hefei Pingbo Network Technology Co. Ltd" or
112            "IDrive, Inc." or
113            "IMPERO SOLUTIONS LIMITED" or
114            "Instant Housecall" or
115            "ISL Online Ltd." or
116            "LogMeIn, Inc." or
117            "LUNIXAR SAS DE CV" or
118            "Monitoring Client" or
119            "MMSOFT Design Ltd." or
120            "Nanosystems S.r.l." or
121            "NetSupport Ltd" or
122            "NetSupport Ltd." or
123            "NETSUPPORT LTD." or
124            "NinjaRMM, LLC" or
125            "Parallels International GmbH" or
126            "philandro Software GmbH" or
127            "Pro Softnet Corporation" or
128            "RealVNC" or
129            "RealVNC Limited" or
130            "BreakingSecurity.net" or
131            "Remote Utilities LLC" or
132            "Rocket Software, Inc." or
133            "SAFIB" or
134            "Servably, Inc." or
135            "ShowMyPC INC" or
136            "Splashtop Inc." or
137            "Superops Inc." or
138            "TeamViewer" or
139            "TeamViewer GmbH" or
140            "TeamViewer Germany GmbH" or
141            "Techinline Limited" or
142            "uvnc bvba" or
143            "Yakhnovets Denis Aleksandrovich IP" or
144            "Zhou Huabing" or
145            "ZOHO Corporation Private Limited" or
146            "Connectwise, LLC" or  
147			"ScreenConnect Client" or
148			"Servably Inc."
149        ) or
150
151        process.name.caseless : (
152            AA_v*.exe or
153            "AeroAdmin.exe" or
154            "AnyDesk.exe" or
155            "apc_Admin.exe" or
156            "apc_host.exe" or
157            "AteraAgent.exe" or
158            aweray_remote*.exe or
159            "AweSun.exe" or
160            "AgentMon.exe" or
161            "B4-Service.exe" or
162            "BASupSrvc.exe" or
163            "bomgar-scc.exe" or
164            "domotzagent.exe" or
165            "domotz-windows-x64-10.exe" or
166            "dwagsvc.exe" or
167            "DWRCC.exe" or
168            "ImperoClientSVC.exe" or
169            "ImperoServerSVC.exe" or
170            "ISLLight.exe" or
171            "ISLLightClient.exe" or
172            fleetdeck_commander*.exe or
173            "getscreen.exe" or
174            "g2aservice.exe" or
175            "GoToAssistService.exe" or
176            "gotohttp.exe" or
177            "jumpcloud-agent.exe" or
178            "level.exe" or
179            "LvAgent.exe" or
180            "LMIIgnition.exe" or
181            "LogMeIn.exe" or
182            "Lunixar.exe" or
183            "LunixarRemote.exe" or
184            "LunixarUpdater.exe" or
185            "ManageEngine_Remote_Access_Plus.exe" or
186            "MeshAgent.exe" or
187            "Mikogo-Service.exe" or
188            "NinjaRMMAgent.exe" or
189            "NinjaRMMAgenPatcher.exe" or
190            "ninjarmm-cli.exe" or
191            "parsec.exe" or
192            "PService.exe" or
193            "quickassist.exe" or
194            "r_server.exe" or
195            "radmin.exe" or
196            "radmin3.exe" or
197            "RCClient.exe" or
198            "RCService.exe" or
199            "RemoteDesktopManager.exe" or
200            "RemotePC.exe" or
201            "RemotePCDesktop.exe" or
202            "RemotePCService.exe" or
203            "rfusclient.exe" or
204            "ROMServer.exe" or
205            "ROMViewer.exe" or
206            "RPCSuite.exe" or
207            "rserver3.exe" or
208            "rustdesk.exe" or
209            "rutserv.exe" or
210            "rutview.exe" or
211            "saazapsc.exe" or
212            ScreenConnect*.exe or
213            "session_win.exe" or
214            "Remote Support.exe" or
215            "smpcview.exe" or
216            "spclink.exe" or
217            "Splashtop-streamer.exe" or
218            "Syncro.Overmind.Service.exe" or
219            "SyncroLive.Agent.Runner.exe" or
220            "SRService.exe" or
221            "strwinclt.exe" or
222            "Supremo.exe" or
223            "SupremoService.exe" or
224            "tacticalrmm.exe" or
225            "tailscale.exe" or
226            "tailscaled.exe" or
227            "teamviewer.exe" or
228            "ToDesk_Service.exe" or
229            "twingate.exe" or
230            "TiClientCore.exe" or
231            "TSClient.exe" or
232            "tvn.exe" or
233            "tvnserver.exe" or
234            "tvnviewer.exe" or
235            UltraVNC*.exe or
236            UltraViewer*.exe or
237            "vncserver.exe" or
238            "vncviewer.exe" or
239            "winvnc.exe" or
240            "winwvc.exe" or
241            "Zaservice.exe" or
242            "ZohoURS.exe" or
243            "Velociraptor.exe" or
244            "ToolsIQ.exe" or
245            "CagService.exe" or 
246			"ScreenConnect.ClientService.exe" or 
247			"TiAgent.exe" or 
248			"GoToResolveProcessChecker.exe" or 
249			"GoToResolveUnattended.exe" or 
250			"Syncro.Installer.exe"
251        ) or
252        process.name : (
253            AA_v*.exe or
254            "AeroAdmin.exe" or
255            "AnyDesk.exe" or
256            "apc_Admin.exe" or
257            "apc_host.exe" or
258            "AteraAgent.exe" or
259            aweray_remote*.exe or
260            "AweSun.exe" or
261            "AgentMon.exe" or
262            "B4-Service.exe" or
263            "BASupSrvc.exe" or
264            "bomgar-scc.exe" or
265            "CagService.exe" or
266            "domotzagent.exe" or
267            "domotz-windows-x64-10.exe" or
268            "dwagsvc.exe" or
269            "DWRCC.exe" or
270            "ImperoClientSVC.exe" or
271            "ImperoServerSVC.exe" or
272            "ISLLight.exe" or
273            "ISLLightClient.exe" or
274            fleetdeck_commander*.exe or
275            "getscreen.exe" or
276            "g2aservice.exe" or
277            "GoToAssistService.exe" or
278            "gotohttp.exe" or
279            "jumpcloud-agent.exe" or
280            "level.exe" or
281            "LvAgent.exe" or
282            "LMIIgnition.exe" or
283            "LogMeIn.exe" or
284            "Lunixar.exe" or
285            "LunixarRemote.exe" or
286            "LunixarUpdater.exe" or
287            "ManageEngine_Remote_Access_Plus.exe" or
288            "MeshAgent.exe" or
289            "meshagent.exe" or
290            "Mikogo-Service.exe" or
291            "NinjaRMMAgent.exe" or
292            "NinjaRMMAgenPatcher.exe" or
293            "ninjarmm-cli.exe" or
294            "parsec.exe" or
295            "PService.exe" or
296            "quickassist.exe" or
297            "r_server.exe" or
298            "radmin.exe" or
299            "radmin3.exe" or
300            "RCClient.exe" or
301            "RCService.exe" or
302            "RemoteDesktopManager.exe" or
303            "RemotePC.exe" or
304            "RemotePCDesktop.exe" or
305            "RemotePCService.exe" or
306            "rfusclient.exe" or
307            "ROMServer.exe" or
308            "ROMViewer.exe" or
309            "RPCSuite.exe" or
310            "rserver3.exe" or
311            "rustdesk.exe" or
312            "rutserv.exe" or
313            "rutview.exe" or
314            "saazapsc.exe" or
315            ScreenConnect*.exe or
316            "session_win.exe" or
317            "Remote Support.exe" or
318            "smpcview.exe" or
319            "spclink.exe" or
320            "Splashtop-streamer.exe" or
321            "Syncro.Overmind.Service.exe" or
322            "SyncroLive.Agent.Runner.exe" or
323            "SRService.exe" or
324            "strwinclt.exe" or
325            "Supremo.exe" or
326            "SupremoService.exe" or
327            "tacticalrmm.exe" or
328            "tailscale.exe" or
329            "tailscaled.exe" or
330            "teamviewer.exe" or
331            "TiClientCore.exe" or
332            "ToDesk_Service.exe" or
333            "twingate.exe" or
334            "TSClient.exe" or
335            "tvn.exe" or
336            "tvnserver.exe" or
337            "tvnviewer.exe" or
338            UltraVNC*.exe or
339            UltraViewer*.exe or
340            "vncserver.exe" or
341            "vncviewer.exe" or
342            "winvnc.exe" or
343            "winwvc.exe" or
344            "Zaservice.exe" or
345            "ZohoURS.exe" or
346            "Velociraptor.exe" or
347            "ToolsIQ.exe" or 
348			"ScreenConnect.ClientService.exe" or 
349			"TiAgent.exe" or 
350			"GoToResolveProcessChecker.exe" or 
351			"GoToResolveUnattended.exe" or 
352			"Syncro.Installer.exe"
353        ) or
354        process.parent.code_signature.subject_name : (
355            "Action1 Corporation" or
356            "AeroAdmin LLC" or
357            "Ammyy LLC" or
358            "Atera Networks Ltd" or
359            "AWERAY PTE. LTD." or
360            "BeamYourScreen GmbH" or
361            "Bomgar Corporation" or
362            "DUC FABULOUS CO.,LTD" or
363            "DOMOTZ INC." or
364            "DWSNET OÜ" or
365            "FleetDeck Inc" or
366            "GlavSoft LLC" or
367            "GlavSoft LLC." or
368            "Hefei Pingbo Network Technology Co. Ltd" or
369            "IDrive, Inc." or
370            "IMPERO SOLUTIONS LIMITED" or
371            "Instant Housecall" or
372            "ISL Online Ltd." or
373            "LogMeIn, Inc." or
374            "LUNIXAR SAS DE CV" or
375            "Monitoring Client" or
376            "MMSOFT Design Ltd." or
377            "Nanosystems S.r.l." or
378            "NetSupport Ltd" or
379            "NetSupport Ltd." or
380            "NETSUPPORT LTD." or
381            "NinjaRMM, LLC" or
382            "Parallels International GmbH" or
383            "philandro Software GmbH" or
384            "Pro Softnet Corporation" or
385            "RealVNC" or
386            "RealVNC Limited" or
387            "BreakingSecurity.net" or
388            "Remote Utilities LLC" or
389            "Rocket Software, Inc." or
390            "SAFIB" or
391            "Servably, Inc." or
392            "ShowMyPC INC" or
393            "Splashtop Inc." or
394            "Superops Inc." or
395            "TeamViewer" or
396            "TeamViewer GmbH" or
397            "TeamViewer Germany GmbH" or
398            "Techinline Limited" or
399            "uvnc bvba" or
400            "Yakhnovets Denis Aleksandrovich IP" or
401            "Zhou Huabing" or
402            "ZOHO Corporation Private Limited" or
403            "Connectwise, LLC" or 
404			"ScreenConnect Client" or
405			"Servably Inc."
406        ) or
407        process.parent.name: (
408            AA_v*.exe or
409            "AeroAdmin.exe" or
410            "AnyDesk.exe" or
411            "apc_Admin.exe" or
412            "apc_host.exe" or
413            "AteraAgent.exe" or
414            aweray_remote*.exe or
415            "AweSun.exe" or
416            "AgentMon.exe" or
417            "B4-Service.exe" or
418            "BASupSrvc.exe" or
419            "bomgar-scc.exe" or
420            "domotzagent.exe" or
421            "domotz-windows-x64-10.exe" or
422            "dwagsvc.exe" or
423            "DWRCC.exe" or
424            "ImperoClientSVC.exe" or
425            "ImperoServerSVC.exe" or
426            "ISLLight.exe" or
427            "ISLLightClient.exe" or
428            fleetdeck_commander*.exe or
429            "getscreen.exe" or
430            "g2aservice.exe" or
431            "GoToAssistService.exe" or
432            "gotohttp.exe" or
433            "jumpcloud-agent.exe" or
434            "level.exe" or
435            "LvAgent.exe" or
436            "LMIIgnition.exe" or
437            "LogMeIn.exe" or
438            "Lunixar.exe" or
439            "LunixarRemote.exe" or
440            "LunixarUpdater.exe" or
441            "ManageEngine_Remote_Access_Plus.exe" or
442            "MeshAgent.exe" or
443            "Mikogo-Service.exe" or
444            "NinjaRMMAgent.exe" or
445            "NinjaRMMAgenPatcher.exe" or
446            "ninjarmm-cli.exe" or
447            "parsec.exe" or
448            "PService.exe" or
449            "quickassist.exe" or
450            "r_server.exe" or
451            "radmin.exe" or
452            "radmin3.exe" or
453            "RCClient.exe" or
454            "RCService.exe" or
455            "RemoteDesktopManager.exe" or
456            "RemotePC.exe" or
457            "RemotePCDesktop.exe" or
458            "RemotePCService.exe" or
459            "rfusclient.exe" or
460            "ROMServer.exe" or
461            "ROMViewer.exe" or
462            "RPCSuite.exe" or
463            "rserver3.exe" or
464            "rustdesk.exe" or
465            "rutserv.exe" or
466            "rutview.exe" or
467            "saazapsc.exe" or
468            ScreenConnect*.exe or
469            "session_win.exe" or
470            "Remote Support.exe" or
471            "smpcview.exe" or
472            "spclink.exe" or
473            "Splashtop-streamer.exe" or
474            "Syncro.Overmind.Service.exe" or
475            "SyncroLive.Agent.Runner.exe" or
476            "SRService.exe" or
477            "strwinclt.exe" or
478            "Supremo.exe" or
479            "SupremoService.exe" or
480            "tacticalrmm.exe" or
481            "tailscale.exe" or
482            "tailscaled.exe" or
483            "teamviewer.exe" or
484            "ToDesk_Service.exe" or
485            "twingate.exe" or
486            "TiClientCore.exe" or
487            "TSClient.exe" or
488            "tvn.exe" or
489            "tvnserver.exe" or
490            "tvnviewer.exe" or
491            UltraVNC*.exe or
492            UltraViewer*.exe or
493            "vncserver.exe" or
494            "vncviewer.exe" or
495            "winvnc.exe" or
496            "winwvc.exe" or
497            "Zaservice.exe" or
498            "ZohoURS.exe" or
499            "Velociraptor.exe" or
500            "ToolsIQ.exe" or
501            "CagService.exe" or 
502			"TiAgent.exe" or 
503			"GoToResolveProcessChecker.exe" or 
504			"GoToResolveUnattended.exe"
505        )
506  ) and
507  not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
508'''
509
510
511[[rule.threat]]
512framework = "MITRE ATT&CK"
513
514[[rule.threat.technique]]
515id = "T1219"
516name = "Remote Access Tools"
517reference = "https://attack.mitre.org/techniques/T1219/"
518
519[[rule.threat.technique.subtechnique]]
520id = "T1219.002"
521name = "Remote Desktop Software"
522reference = "https://attack.mitre.org/techniques/T1219/002/"
523
524[rule.threat.tactic]
525id = "TA0011"
526name = "Command and Control"
527reference = "https://attack.mitre.org/tactics/TA0011/"
528
529[rule.new_terms]
530field = "new_terms_fields"
531value = ["host.id", "process.name"]
532[[rule.new_terms.history_window_start]]
533field = "history_window_start"
534value = "now-7d"