Potential RMM Execution from a Commonly Abused Web Service

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "ES|QL FROM subqueries require Elastic Stack 9.5.0 or later."
  6min_stack_version = "9.5.0"
  7updated_date = "2026/09/16"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management
 13(RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver
 14remote-access software during social engineering and intrusion campaigns.
 15"""
 16false_positives = [
 17    "Publishers in the maintained signer list may also sign scanners, backup clients, or other non-RMM software. Confirm the actual product and purpose from executable, command-line, hash, and deployment evidence.",
 18    "IT or managed service providers may distribute RMM binaries through public hosting or shared download links. Confirm the package, host, operator, timing, and enrollment destination against a change record or support ticket.",
 19]
 20from = "now-25m"
 21interval = "5m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Potential RMM Execution from a Commonly Abused Web Service"
 25references = [
 26    "https://www.huntress.com/blog/series-of-unfortunate-rmm-events",
 27    "https://www.cloudflare.com/cloudforce-one/research/report/vercel-hosted-rmm-abuse-campaign-evolves-with-telegram-c2-for-victim-filtering/",
 28    "https://www.cloudflare.com/cloudforce-one/research/new-ssa-themed-phishing-campaign-installs-trojanized-screenconnect/",
 29    "https://www.forescout.com/blog/from-urls-to-malware-how-threat-actors-abuse-domain-security-in-2025/",
 30    "https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access",
 31]
 32risk_score = 21
 33rule_id = "e06df914-e526-4a52-ab9d-0fd10d8015dd"
 34severity = "low"
 35tags = [
 36    "Domain: Endpoint",
 37    "OS: Windows",
 38    "Platform: Windows",
 39    "Rule Type: ES|QL",
 40    "Threat: Remote Management Tool Abuse",
 41    "Use Case: Threat Detection",
 42    "Tactic: Command and Control",
 43    "Data Source: Elastic Defend",
 44]
 45timestamp_override = "event.ingested"
 46type = "esql"
 47
 48query = '''
 49// Union file and process rows. Then INLINE STATS attaches file-origin context for the host and path.
 50// File-origin fallback correlation is only used when process.origin_url is missing or empty.
 51FROM
 52(
 53  FROM logs-endpoint.events.file-*
 54  | WHERE KQL("event.action: creation") AND file.origin_url IS NOT NULL
 55  // Strip the terminal :Zone.Identifier ADS suffix and optional :$DATA stream type from the file path so we can correlate with the process event.
 56  | EVAL is_execution = false, origin_url = file.origin_url,
 57      executable_path = REPLACE(TO_LOWER(file.path), ":zone[.]identifier(:[$]data)?$", "")
 58),
 59(
 60  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
 61  | WHERE host.os.type == "windows" AND KQL("event.type: start")
 62  | WHERE process.code_signature.subject_name IN (
 63      "Action1 Corporation", "Aeroadmin LLC", "AeroAdmin LLC", "AmidaWare LLC", "Ammyy LLC", "AnyDesk Software GmbH",
 64      "AOMEI International Network Limited", "Atera Networks Ltd", "AWERAY PTE. LTD.", "BeamYourScreen GmbH",
 65      "Bomgar Corporation", "BreakingSecurity.net", "ConnectWise, Inc.", "ConnectWise, LLC", "Connectwise, LLC",
 66      "Devolutions Inc", "Devolutions inc.", "DOMOTZ INC.", "DUC FABULOUS CO.,LTD", "DWSNET OÜ", "DWSNET srl",
 67      "Electronic Team, Inc.", "Famatech Corp.", "FleetDeck Inc", "FLEETDECK INC.", "GlavSoft LLC", "GlavSoft LLC.",
 68      "GoTo Technologies USA, LLC", "Hefei Pingbo Network Technology Co. Ltd", "IDrive, Inc.",
 69      "Impero Solutions Limited", "IMPERO SOLUTIONS LIMITED", "Instant Housecall", "ISL Online Ltd.", "JumpCloud Inc",
 70      "Level Software, Inc.", "LogMeIn, Inc.", "LUNIXAR SAS DE CV", "MMSOFT Design Ltd.", "Monitoring Client",
 71      "MSPBytes Corp", "MSPBytes, Corp.", "N-ABLE TECHNOLOGIES LTD", "Nanosystems S.r.l.", "NetSupport Ltd",
 72      "NetSupport Ltd.", "NETSUPPORT LTD.", "NinjaOne LLC", "NinjaRMM, LLC", "Open Source Developer, Huabing Zhou",
 73      "Parallels International GmbH", "philandro Software GmbH", "Pro Softnet Corporation", "PURSLANE", "RealVNC",
 74      "RealVNC Limited", "REMOTE UTILITIES PTE. LTD.", "Remote Utilities LLC", "Rocket Software, Inc.",
 75      "Rsupport Co., Ltd.", "SAFIB", "ScreenConnect Client", "Servably, Inc.", "Servably Inc.", "ShowMyPC INC",
 76      "SimpleHelp Ltd", "Splashtop Inc.", "Superops Inc.", "Tailscale Inc.", "TeamViewer", "TeamViewer GmbH",
 77      "TeamViewer Germany GmbH", "Techinline Limited", "uvnc bvba", "Yakhnovets Denis Aleksandrovich IP",
 78      "Zhou Huabing", "ZOHO Corporation Private Limited"
 79    )
 80  | EVAL is_execution = true, origin_url = process.origin_url, executable_path = TO_LOWER(process.executable)
 81)
 82
 83// Both process.origin_url and file.origin_url are copied to the common origin_url variable in the subqueries.
 84// So we can use the same logic for both the primary and fallback origin_url.
 85| URI_PARTS origin = origin_url
 86
 87// Preserve executions with null/empty origin URLs so they can fall back to file origin if needed.
 88| WHERE (is_execution AND (origin_url IS NULL OR origin_url == "")) OR
 89    // Source code and developer artifact hosting.
 90    TO_LOWER(origin.domain) LIKE (
 91      "api.bitbucket.org", "bitbucket.org", "api.github.com", "gist.githubusercontent.com", "github.com",
 92      "github-releases.githubusercontent.com", "objects.githubusercontent.com", "raw.githack.com",
 93      "raw.githubusercontent.com", "rawcdn.githack.com", "release-assets.githubusercontent.com", "gitlab.com",
 94      "*.gitlab.com", "notabug.org", "sourceforge.net", "*.sourceforge.net"
 95    ) OR
 96    // AWS S3 object storage.
 97    TO_LOWER(origin.domain) LIKE (
 98      "s3.amazonaws.com", "*.s3.amazonaws.com", "s3.*.amazonaws.com", "*.s3.*.amazonaws.com", "s3-*.amazonaws.com",
 99      "*.s3-*.amazonaws.com", "*.s3express-*.amazonaws.com"
100    ) OR
101    // Azure, Cloudflare R2, Discord, and Dropbox.
102    TO_LOWER(origin.domain) LIKE (
103      "*.azurewebsites.net", "*.azurestaticapps.net", "*.azurecontainerapps.io", "*.blob.core.windows.net",
104      "*.blob.storage.azure.net", "*.web.core.windows.net", "*.web.storage.azure.net", "*.file.core.windows.net",
105      "*.azurefd.net", "*.azureedge.net", "*.r2.dev", "cdn.discordapp.com", "dropbox.com", "*.dropbox.com",
106      "dropboxusercontent.com", "*.dropboxusercontent.com"
107    ) OR
108    // Firebase Storage, Google Drive, and Cloud Storage.
109    TO_LOWER(origin.domain) LIKE (
110      "*.googleusercontent.com", "content-storage.googleapis.com", "firebasestorage.googleapis.com", "docs.google.com",
111      "drive.google.com", "drive.usercontent.google.com", "storage-download.googleapis.com", "storage.googleapis.com",
112      "*.storage.googleapis.com", "www.googleapis.com"
113    ) OR
114    // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
115    TO_LOWER(origin.domain) LIKE (
116      "api.onedrive.com", "files.1drv.com", "*.files.1drv.com", "onedrive.live.com", "*.onedrive.live.com",
117      "sharepoint.com", "*.sharepoint.com", "storage.live.com", "*.storage.live.com", "onehub.com", "*.onehub.com",
118      "onlyoffice.com", "*.onlyoffice.com", "pcloud.com", "*.pcloud.com", "files.slack.com", "slack-files.com",
119      "*.supabase.co", "s3.wasabisys.com", "*.s3.wasabisys.com", "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
120    ) OR
121    // Developer tunnels, reverse proxies, automation, and webhooks.
122    TO_LOWER(origin.domain) LIKE (
123      "devtunnels.ms", "*.devtunnels.ms", "localtunnel.me", "*.localtunnel.me", "n8n.cloud", "*.n8n.cloud",
124      "*.ngrok.app", "*.ngrok.dev", "*.ngrok-free.app", "*.ngrok-free.dev", "*.ngrok.io", "*.ngrok.pizza",
125      "*.ngrok.pro", "pagekite.me", "*.pagekite.me", "serveo.net", "*.serveo.net", "trycloudflare.com",
126      "*.trycloudflare.com", "webhook.site"
127    ) OR
128    // File-sharing and transfer services.
129    TO_LOWER(origin.domain) LIKE (
130      "4shared.com", "*.4shared.com", "*.4sync.com", "bashupload.com", "*.bashupload.com", "catbox.moe", "*.catbox.moe",
131      "easyupload.io", "*.easyupload.io", "file.io", "filebin.net", "filecloud.me", "files.fm", "*.files.fm",
132      "filetransfer.io", "*.filetransfer.io", "gofile.io", "*.gofile.io", "limewire.com", "*.limewire.com",
133      "mediafire.com", "*.mediafire.com", "mega.co.nz", "*.mega.co.nz", "mega.nz", "*.mega.nz", "pixeldrain.com",
134      "*.pixeldrain.com", "send.cm", "*.send.cm", "send.now", "*.send.now", "sendit.sh", "*.sendit.sh", "sendspace.com",
135      "*.sendspace.com", "share.riseup.net", "temp.sh", "tempsend.com", "transfer.sh", "ufile.io", "*.ufile.io",
136      "upload.ee", "*.upload.ee", "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net", "workupload.com"
137    ) OR
138    // CDN, paste, and public hosting services.
139    TO_LOWER(origin.domain) LIKE (
140      "*.alwaysdata.net", "blogspot.com", "*.blogspot.com", "b-cdn.net", "*.b-cdn.net", "cdnmegafiles.com",
141      "*.cdnmegafiles.com", "infinityfreeapp.com", "*.infinityfreeapp.com", "free.keep.sh", "*.netlify.app", "paste.ee",
142      "publicvm.com", "*.publicvm.com", "*.vercel.app", "*.*.workers.dev"
143    ) OR
144    // Decentralized and content-addressed storage.
145    TO_LOWER(origin.domain) LIKE (
146      "ar.io", "*.ar.io", "arweave.net", "*.arweave.net", "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io", "dweb.link",
147      "*.dweb.link", "gateway.pinata.cloud", "ipfs.io", "*.ipfs.io", "mypinata.cloud", "*.mypinata.cloud",
148      "nftstorage.link", "*.nftstorage.link", "storjshare.io", "*.storjshare.io", "web3.storage", "*.web3.storage"
149    )
150
151// For events where process.origin_url is missing or empty, we can look for file.origin_url values on the same host and path.
152| INLINE STATS Esql.file_origin_time = MIN(@timestamp) WHERE is_execution == false,
153    Esql.file_origin_urls = VALUES(origin_url) WHERE is_execution == false
154  BY host.id, executable_path
155// For fallback, at least one qualifying file event must happen at or before the process event.
156| WHERE is_execution AND (
157    (origin_url IS NOT NULL AND origin_url != "") OR @timestamp >= Esql.file_origin_time
158  )
159
160| KEEP @timestamp, _id, _version, _index, event.type, host.id, host.name, user.name,
161    process.entity_id, process.executable, process.command_line, process.hash.sha256,
162    process.code_signature.subject_name, process.code_signature.trusted, process.origin_url,
163    Esql.file_origin_time, Esql.file_origin_urls
164| SORT @timestamp DESC, _index ASC, _id ASC
165'''
166
167setup = """## Setup
168
169This rule requires Elastic Defend on Windows with process and file event collection, process code-signature metadata, and executable-origin URLs on process events or file creation events.
170
171Setup instructions: https://ela.st/install-elastic-defend
172"""
173
174[rule.investigation_fields]
175field_names = [
176    "host.name",
177    "user.name",
178    "process.executable",
179    "process.command_line",
180    "process.code_signature.subject_name",
181    "process.code_signature.trusted",
182    "process.hash.sha256",
183    "process.origin_url",
184    "Esql.file_origin_urls",
185    "Esql.file_origin_time",
186]
187
188[[rule.threat]]
189framework = "MITRE ATT&CK"
190
191[[rule.threat.technique]]
192id = "T1105"
193name = "Ingress Tool Transfer"
194reference = "https://attack.mitre.org/techniques/T1105/"
195
196[[rule.threat.technique]]
197id = "T1219"
198name = "Remote Access Tools"
199reference = "https://attack.mitre.org/techniques/T1219/"
200
201[[rule.threat.technique.subtechnique]]
202id = "T1219.002"
203name = "Remote Desktop Software"
204reference = "https://attack.mitre.org/techniques/T1219/002/"
205
206[rule.threat.tactic]
207id = "TA0011"
208name = "Command and Control"
209reference = "https://attack.mitre.org/tactics/TA0011/"