RMM Software Installation from a Commonly Abused Web Service

  1[metadata]
  2creation_date = "2026/08/07"
  3integration = ["endpoint"]
  4maturity = "production"
  5min_stack_comments = "FROM subquery support became generally available in 9.5.0"
  6min_stack_version = "9.5.0"
  7updated_date = "2026/09/18"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies Windows Installer (MSI) packages that originate from commonly abused web services and install a recognized
 13remote monitoring and management (RMM) product. Adversaries may abuse legitimate RMM software in social engineering
 14campaigns to gain remote access and control over victim systems. This rule does not establish that the origin,
 15installer, or RMM product is inherently malicious. Origins outside this set are covered by the companion rule "RMM
 16Software Installation from an Internet-Originated MSI".
 17"""
 18false_positives = [
 19    """
 20    Authorized IT or managed service provider deployment of remote monitoring and management software through public,
 21    vendor, or software distribution infrastructure can produce this behavior.
 22    """,
 23]
 24from = "now-25m"
 25interval = "5m"
 26language = "esql"
 27license = "Elastic License v2"
 28name = "RMM Software Installation from a Commonly Abused Web Service"
 29note = """ ## Triage and analysis
 30
 31> **Disclaimer**:
 32> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 33
 34### Investigating RMM Software Installation from a Commonly Abused Web Service
 35
 36This rule detects a Windows MSI downloaded from a commonly abused hosting service, executed shortly afterward, and followed by installation of a recognized remote management tool, a sequence that can establish covert remote access. An attacker may send a phishing link to a file-sharing site, persuade the user to run the downloaded installer, and deploy an unattended remote-control agent for persistent system access.
 37
 38### Possible investigation steps
 39
 40- Validate the MSI’s digital signature, publisher, SHA-256 reputation, download URL, and referrer to distinguish an official vendor package from a repackaged or impersonated installer.
 41- Review the user’s browser, email, chat, and recent authentication activity to determine how the download was initiated and whether the RMM installation was authorized by IT.
 42- Reconstruct the execution chain around the installer, including its parent process, command-line options, privilege elevation, and any scripts or utilities launched immediately before or after installation.
 43- Examine the installed RMM product’s services, scheduled tasks, registry entries, configuration files, enrollment identifiers, and outbound connections for unattended access or linkage to an unknown tenant.
 44- Hunt across the environment for the same MSI hash, source URL, RMM executable, publisher, destination infrastructure, or enrollment details, and isolate affected hosts if the deployment is unauthorized.
 45
 46### False positive analysis
 47
 48- An authorized administrator may install an approved RMM package hosted on a listed source-code, cloud-storage, or file-sharing domain; confirm the user, host, MSI signature and hash, source URL, and deployment timing against an approved change record.
 49- A user may install an approved remote-support client from a legitimate shared download link during a scheduled support session; verify the session with the user or support team and confirm the installed agent is enrolled in the organization’s expected tenant.
 50
 51### Response and remediation
 52
 53- Isolate affected Windows hosts from the network while preserving management access, and block the malicious MSI hash, download URL, and identified RMM destination infrastructure.
 54- Terminate active RMM sessions and processes, uninstall the unauthorized agent, remove its services, scheduled tasks, startup registry entries, configuration files, enrollment identifiers, and downloaded MSI, and verify that none are recreated.
 55- Disable or reset the affected user and RMM-associated accounts, revoke active sessions and tokens, rotate exposed privileged credentials, and review remote logons for unauthorized access.
 56- Escalate immediately to incident response if the RMM agent ran with administrative privileges, appears on multiple hosts, used an unknown tenant, enabled lateral movement, or accessed sensitive systems or data.
 57- Reimage hosts from a trusted baseline when system integrity cannot be established, restore only validated data, patch the system, and confirm the unauthorized RMM executable and persistence mechanisms are absent before reconnecting it.
 58- Prevent recurrence by allowlisting approved RMM products and tenants, restricting MSI execution and unapproved remote-access tools, filtering known malicious hosting URLs, and requiring documented authorization for remote-support installations.
 59"""
 60references = [
 61    "https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice",
 62    "https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/",
 63    "https://www.forcepoint.com/blog/x-labs/screenconnect-attack",
 64    "https://www.levelblue.com/blogs/spiderlabs-blog/beyond-fake-updates-from-application-store-themed-phishing-to-large-scale-distribution-of-screenconnect",
 65    "https://www.security.com/threat-intelligence/rmm-logmein-attacks",
 66    "https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill",
 67    "https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399",
 68    "https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm",
 69    "https://www.fortian.com.au/blog/trusted-domains-disposable-infrastructure-tax-season-phishing-on-vercel.html",
 70    "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution",
 71]
 72risk_score = 47
 73rule_id = "ed626330-f3ac-4568-b4e4-cbc296748320"
 74setup = """## Setup
 75
 76This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 77
 78Setup instructions: https://ela.st/install-elastic-defend
 79"""
 80severity = "medium"
 81tags = [
 82    "Domain: Endpoint",
 83    "OS: Windows",
 84    "Platform: Windows",
 85    "Rule Type: ES|QL",
 86    "Use Case: Threat Detection",
 87    "Tactic: Defense Evasion",
 88    "Tactic: Command and Control",
 89    "Data Source: Elastic Defend",
 90    "Resources: Investigation Guide",
 91]
 92timestamp_override = "event.ingested"
 93type = "esql"
 94
 95query = '''
 96/*
 97Correlate three events on the same host: an MSI downloaded from a commonly abused web service, the same user running
 98that MSI with msiexec within 10 minutes, and msiexec creating a known RMM executable within 5 more minutes. Keep the
 99MSI download event as the alert.
100*/
101FROM
102(
103  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
104    | WHERE KQL("event.action: creation") AND TO_LOWER(file.extension) == "msi" AND file.origin_url IS NOT NULL
105    | EVAL Esql.sequence_stage = "origin"
106    | URI_PARTS Esql.origin = file.origin_url
107    | EVAL Esql.origin.domain = TO_LOWER(Esql.origin.domain)
108    | WHERE (
109      // Source code and developer artifact hosting.
110      Esql.origin.domain LIKE (
111        "api.bitbucket.org", "bitbucket.org",
112        "api.github.com", "gist.githubusercontent.com", "github.com",
113        "github-releases.githubusercontent.com", "objects.githubusercontent.com",
114        "raw.githack.com", "raw.githubusercontent.com", "rawcdn.githack.com",
115        "release-assets.githubusercontent.com",
116        "gitlab.com", "*.gitlab.com",
117        "notabug.org",
118        "sourceforge.net", "*.sourceforge.net"
119      ) OR
120      // AWS S3 object storage.
121      Esql.origin.domain LIKE (
122        "s3.amazonaws.com", "*.s3.amazonaws.com",
123        "s3.*.amazonaws.com", "*.s3.*.amazonaws.com",
124        "s3-*.amazonaws.com", "*.s3-*.amazonaws.com",
125        "*.s3express-*.amazonaws.com"
126      ) OR
127      // Azure, Cloudflare R2, Discord, and Dropbox.
128      Esql.origin.domain LIKE (
129        "*.azurewebsites.net", "*.azurestaticapps.net",
130        "*.azurecontainerapps.io",
131        "*.blob.core.windows.net", "*.blob.storage.azure.net",
132        "*.web.core.windows.net", "*.web.storage.azure.net",
133        "*.file.core.windows.net",
134        "*.azurefd.net", "*.azureedge.net",
135        "*.r2.dev",
136        "cdn.discordapp.com",
137        "dropbox.com", "*.dropbox.com",
138        "dropboxusercontent.com", "*.dropboxusercontent.com"
139      ) OR
140      // Firebase Storage, Google Drive, and Cloud Storage.
141      Esql.origin.domain LIKE (
142        "*.googleusercontent.com", "content-storage.googleapis.com",
143        "firebasestorage.googleapis.com",
144        "docs.google.com", "drive.google.com", "drive.usercontent.google.com",
145        "storage-download.googleapis.com", "storage.googleapis.com", "*.storage.googleapis.com",
146        "www.googleapis.com"
147      ) OR
148      // OneDrive, SharePoint, Onehub, OnlyOffice, pCloud, Slack, Supabase, and Wasabi.
149      Esql.origin.domain LIKE (
150        "api.onedrive.com", "files.1drv.com", "*.files.1drv.com",
151        "onedrive.live.com", "*.onedrive.live.com",
152        "sharepoint.com", "*.sharepoint.com",
153        "storage.live.com", "*.storage.live.com",
154        "onehub.com", "*.onehub.com",
155        "onlyoffice.com", "*.onlyoffice.com",
156        "pcloud.com", "*.pcloud.com",
157        "files.slack.com", "slack-files.com",
158        "*.supabase.co",
159        "s3.wasabisys.com", "*.s3.wasabisys.com",
160        "s3.*.wasabisys.com", "*.s3.*.wasabisys.com"
161      ) OR
162      // Developer tunnels, reverse proxies, automation, and webhooks.
163      Esql.origin.domain LIKE (
164        "devtunnels.ms", "*.devtunnels.ms",
165        "localtunnel.me", "*.localtunnel.me",
166        "n8n.cloud", "*.n8n.cloud",
167        "*.ngrok.app", "*.ngrok.dev",
168        "*.ngrok-free.app", "*.ngrok-free.dev",
169        "*.ngrok.io", "*.ngrok.pizza", "*.ngrok.pro",
170        "pagekite.me", "*.pagekite.me",
171        "serveo.net", "*.serveo.net",
172        "trycloudflare.com", "*.trycloudflare.com",
173        "webhook.site"
174      ) OR
175      // File-sharing and transfer services.
176      Esql.origin.domain LIKE (
177        "4shared.com", "*.4shared.com",
178        "*.4sync.com",
179        "bashupload.com", "*.bashupload.com",
180        "catbox.moe", "*.catbox.moe",
181        "easyupload.io", "*.easyupload.io",
182        "file.io",
183        "filebin.net",
184        "filecloud.me",
185        "files.fm", "*.files.fm",
186        "filetransfer.io", "*.filetransfer.io",
187        "gofile.io", "*.gofile.io",
188        "limewire.com", "*.limewire.com",
189        "mediafire.com", "*.mediafire.com",
190        "mega.co.nz", "*.mega.co.nz",
191        "mega.nz", "*.mega.nz",
192        "pixeldrain.com", "*.pixeldrain.com",
193        "send.cm", "*.send.cm", "send.now", "*.send.now",
194        "sendit.sh", "*.sendit.sh",
195        "sendspace.com", "*.sendspace.com",
196        "share.riseup.net",
197        "temp.sh", "tempsend.com",
198        "transfer.sh",
199        "ufile.io", "*.ufile.io",
200        "upload.ee", "*.upload.ee",
201        "we.tl", "wetransfer.com", "*.wetransfer.com", "*.wetransfer.net",
202        "workupload.com"
203      ) OR
204      // CDN, paste, and public hosting services.
205      Esql.origin.domain LIKE (
206        "*.alwaysdata.net",
207        "blogspot.com", "*.blogspot.com",
208        "b-cdn.net", "*.b-cdn.net",
209        "cdnmegafiles.com", "*.cdnmegafiles.com",
210        "infinityfreeapp.com", "*.infinityfreeapp.com",
211        "free.keep.sh",
212        "*.netlify.app",
213        "paste.ee",
214        "publicvm.com", "*.publicvm.com",
215        "*.vercel.app",
216        "*.*.workers.dev"
217      ) OR
218      // Decentralized and content-addressed storage.
219      Esql.origin.domain LIKE (
220        "ar.io", "*.ar.io", "arweave.net", "*.arweave.net",
221        "ic0.app", "*.ic0.app", "icp0.io", "*.icp0.io",
222        "dweb.link", "*.dweb.link",
223        "gateway.pinata.cloud",
224        "ipfs.io", "*.ipfs.io",
225        "mypinata.cloud", "*.mypinata.cloud",
226        "nftstorage.link", "*.nftstorage.link",
227        "storjshare.io", "*.storjshare.io",
228        "web3.storage", "*.web3.storage"
229      )
230    )
231),
232(
233  FROM logs-endpoint.events.process-* METADATA _id, _version, _index
234  | WHERE host.os.type == "windows" AND
235      KQL("event.type: start") AND
236      process.name.caseless == "msiexec.exe"
237  | EVAL Esql.sequence_stage = "execute"
238  | KEEP @timestamp, host.id, process.args, user.id, _id, _version, _index, Esql.sequence_stage
239),
240(
241  FROM logs-endpoint.events.file-* METADATA _id, _version, _index
242  | WHERE KQL("event.action: creation") AND process.name.caseless == "msiexec.exe"
243  | EVAL file.name.caseless = TO_LOWER(file.name)
244  | WHERE
245    file.name.caseless IN (
246      // Acronis
247      "acroniscyberprotectconnectagent.exe",
248
249      // AeroAdmin
250      "aeroadmin.exe",
251
252      // AnyDesk
253      "anydesk.exe",
254
255      // APC
256      "apc_admin.exe",
257      "apc_host.exe",
258
259      // Atera
260      "ateraagent.exe",
261
262      // AweSun
263      "awesun.exe",
264
265      // BarracudaRMM
266      "cagservice.exe",
267
268      // BeyondTrust
269      "b4-service.exe",
270      "basupsrvc.exe",
271      "bomgar-scc.exe",
272      "remote support.exe",
273
274      // CloudRadial
275      "cloudracmd.exe",
276      "cloudrasd.exe",
277      "cloudraservice.exe",
278
279      // ConnectWiseAutomate
280      "agentmon.exe",
281      "ltsvc.exe",
282      "ltsvcmon.exe",
283      "lttray.exe",
284
285      // Devolutions
286      "remotedesktopmanager.exe",
287
288      // Domotz
289      "domotz-windows-x64-10.exe",
290      "domotzagent.exe",
291
292      // DWService
293      "dwagsvc.exe",
294      "dwrcc.exe",
295      "dwrcs.exe",
296      "dwrcst.exe",
297
298      // GetScreen
299      "getscreen.exe",
300
301      // GoTo
302      "g2aservice.exe",
303      "gotoassistservice.exe",
304      "gotohttp.exe",
305      "gotoresolveprocesschecker.exe",
306      "gotoresolveremotecontrol.exe",
307      "gotoresolveservice.exe",
308      "gotoresolveterminal.exe",
309      "gotoresolveunattended.exe",
310
311      // HelpWire
312      "helpwire.exe",
313
314      // ImmyBot
315      "immyagent.exe",
316      "immybot.agent.ephemeral.exe",
317      "immyupdater.exe",
318
319      // Impero
320      "imperoclientsvc.exe",
321      "imperoserversvc.exe",
322
323      // ISLOnline
324      "isllight.exe",
325      "isllightclient.exe",
326
327      // JumpCloud
328      "jumpcloud-agent.exe",
329
330      // Kaseya
331      "saazapsc.exe",
332
333      // Komari
334      "komari-agent.exe",
335      "komari.exe",
336
337      // Level
338      "level.exe",
339      "lvagent.exe",
340
341      // LogMeIn
342      "lmi_rescue_srv.exe",
343      "lmi_rescue.exe",
344      "lmiignition.exe",
345      "logmein.exe",
346
347      // Lunixar
348      "lunixar.exe",
349      "lunixarremote.exe",
350      "lunixarupdater.exe",
351
352      // ManageEngine
353      "manageengine_remote_access_plus.exe",
354
355      // MeshCentral
356      "meshagent.exe",
357
358      // Mikogo
359      "mikogo-service.exe",
360
361      // Nezha
362      "nezha-agent.exe",
363
364      // NinjaOne
365      "ninjarmm-cli.exe",
366      "ninjarmmagent.exe",
367      "ninjarmmagentpatcher.exe",
368
369      // Parsec
370      "parsec.exe",
371
372      // PDQ Connect
373      "pdq-connect-agent.exe",
374      "pdq-connect-updater.exe",
375
376      // Pulseway
377      "pservice.exe",
378
379      // QuickAssist
380      "quickassist.exe",
381
382      // Radmin
383      "r_server.exe",
384      "radmin.exe",
385      "radmin3.exe",
386      "rserver3.exe",
387
388      // RealVNC
389      "romserver.exe",
390      "romviewer.exe",
391      "vncserver.exe",
392      "vncviewer.exe",
393      "winvnc.exe",
394
395      // Remotely
396      "remotely_agent.exe",
397      "remotely_desktop.exe",
398
399      // RemotePC
400      "remotepc.exe",
401      "remotepcdesktop.exe",
402      "remotepcservice.exe",
403
404      // RemoteUtilities
405      "rfusclient.exe",
406      "rutserv.exe",
407      "rutview.exe",
408
409      // RPCSuite
410      "rcclient.exe",
411      "rcservice.exe",
412      "rpcsuite.exe",
413
414      // Rsupport
415      "rcengmgru.exe",
416      "rcmgrsvc.exe",
417      "remoteview.exe",
418      "rvagent.exe",
419      "rvagtray.exe",
420
421      // RustDesk
422      "rustdesk.exe",
423
424      // SimpleHelp
425      "simplegatewayservice.exe",
426      "simplehelpcustomer.exe",
427
428      // Splashtop
429      "smpcview.exe",
430      "spclink.exe",
431      "splashtop-streamer.exe",
432      "splashtopsos.exe",
433      "spsrv.exe",
434      "sragent.exe",
435      "srmanager.exe",
436      "srserver.exe",
437      "srservice.exe",
438      "strwinclt.exe",
439
440      // SuperOps
441      "rmm.agent.exe",
442
443      // Supremo
444      "supremo.exe",
445      "supremoservice.exe",
446
447      // Syncro
448      "syncro.app.runner.exe",
449      "syncro.installer.exe",
450      "syncro.overmind.service.exe",
451      "syncro.service.exe",
452      "syncrolive.agent.exe",
453      "syncrolive.agent.runner.exe",
454      "syncrolive.service.exe",
455
456      // TacticalRMM
457      "tacticalrmm.exe",
458
459      // Tailscale
460      "tailscale.exe",
461      "tailscaled.exe",
462
463      // TeamViewer
464      "teamviewer_desktop.exe",
465      "teamviewer_service.exe",
466      "teamviewer.exe",
467
468      // Techinline
469      "tsclient.exe",
470
471      // Tiflux
472      "tiagent.exe",
473      "ticlientcore.exe",
474
475      // TightVNC
476      "tvn.exe",
477      "tvnserver.exe",
478      "tvnviewer.exe",
479
480      // ToDesk
481      "todesk_service.exe",
482
483      // ToolsIQ
484      "toolsiq.exe",
485
486      // Twingate
487      "twingate.exe",
488
489      // Velociraptor
490      "velociraptor.exe",
491
492      // ZohoAssist
493      "session_win.exe",
494      "za_access.exe",
495      "za_connect.exe",
496      "zaservice.exe",
497      "zmagent.exe",
498      "zohomeeting.exe",
499      "zohotray.exe",
500      "zohours.exe",
501      "zohoursservice.exe"
502    ) OR
503    file.name.caseless LIKE (
504      // AnyAssist
505      "aa_v*.exe",
506
507      // AweSun
508      "aweray_remote*.exe",
509
510      // FleetDeck
511      "fleetdeck_commander*.exe",
512
513      // ScreenConnect
514      "connectwisecontrol*.exe",
515      "screenconnect*.exe",
516
517      // UltraViewer
518      "ultraviewer*.exe",
519
520      // UltraVNC
521      "ultravnc*.exe"
522    )
523  // Keep the executable name paired with its creation time through the host-level aggregation.
524  | EVAL
525      Esql.sequence_stage = "install",
526      Esql.install_candidate = CONCAT(TO_STRING(@timestamp), "|", file.name)
527  | KEEP @timestamp, host.id, _id, _version, _index, Esql.sequence_stage, Esql.install_candidate
528)
529
530| WHERE host.id IS NOT NULL
531
532// Attach known RMM executable creation candidates to all rows on the same host.
533// Retain only download and execution candidates from hosts with at least one such creation.
534| INLINE STATS
535    Esql.install_count = COUNT(*) WHERE Esql.sequence_stage == "install",
536    Esql.install_candidates = VALUES(Esql.install_candidate) WHERE Esql.sequence_stage == "install"
537  BY host.id
538| DROP Esql.install_candidate
539| WHERE Esql.sequence_stage IN ("origin", "execute") AND Esql.install_count > 0
540
541// Lowercase the downloaded path and every msiexec argument, remove the :Zone.Identifier marker,
542// and keep values ending in .msi as the shared path key.
543| EVAL
544    Esql.candidate_path = CASE(
545      Esql.sequence_stage == "origin", file.path,
546      process.args
547    ),
548    Esql.actor_user_id = user.id
549| MV_EXPAND Esql.candidate_path
550| EVAL Esql.artifact_path =
551    REPLACE(TO_LOWER(Esql.candidate_path), ":zone.identifier", "")
552| WHERE Esql.artifact_path LIKE "*.msi" AND Esql.actor_user_id IS NOT NULL
553
554// Match the origin event and msiexec start using host, MSI path, and user SID.
555| INLINE STATS
556    Esql.execute_count = COUNT(*) WHERE Esql.sequence_stage == "execute",
557    Esql.execute_times = VALUES(@timestamp) WHERE Esql.sequence_stage == "execute"
558  BY host.id, Esql.artifact_path, Esql.actor_user_id
559| WHERE
560    // Keep the real origin event as the alert document.
561    Esql.sequence_stage == "origin" AND
562    Esql.execute_count > 0
563
564// Require the matching msiexec process to start within 10 minutes after the MSI download.
565| MV_EXPAND Esql.execute_times
566| EVAL Esql.origin_to_execute_s =
567    DATE_DIFF("second", @timestamp, Esql.execute_times)
568| WHERE
569    Esql.origin_to_execute_s >= 0 AND
570    Esql.origin_to_execute_s <= 600
571
572// On the same host, require any msiexec process to create a known RMM executable
573// within 5 minutes after the matched start.
574| MV_EXPAND Esql.install_candidates
575| EVAL
576    Esql.install_time = TO_DATETIME(MV_FIRST(SPLIT(Esql.install_candidates, "|"))),
577    Esql.rmm_file_name = MV_LAST(SPLIT(Esql.install_candidates, "|")),
578    Esql.execute_to_install_s = DATE_DIFF("second", Esql.execute_times, Esql.install_time)
579| DROP Esql.install_candidates
580| WHERE
581    Esql.execute_to_install_s >= 0 AND
582    Esql.execute_to_install_s <= 300
583
584// Select one concrete origin row per host, MSI path, and user, preferring the
585// earliest RMM executable creation when second-level durations tie.
586| SORT
587    Esql.execute_times ASC,
588    Esql.origin_to_execute_s ASC,
589    Esql.execute_to_install_s ASC,
590    Esql.install_time ASC,
591    Esql.rmm_file_name ASC,
592    _id ASC
593| LIMIT 1 BY host.id, Esql.artifact_path, Esql.actor_user_id
594
595| RENAME Esql.execute_times AS Esql.execute_time
596| KEEP
597    @timestamp, _id, _index, _version,
598    event.action, event.category, event.type, event.created, event.ingested,
599    data_stream.dataset, data_stream.namespace,
600    host.id, host.name,
601    user.id, user.name,
602    process.entity_id, process.name, process.executable, process.command_line,
603    file.name, file.path, file.extension, file.origin_url, file.origin_referrer_url,
604    file.size, file.hash.sha256,
605    Esql.origin.domain, Esql.artifact_path, Esql.execute_time,
606    Esql.install_time, Esql.rmm_file_name,
607    Esql.origin_to_execute_s, Esql.execute_to_install_s
608'''
609
610
611[[rule.threat]]
612framework = "MITRE ATT&CK"
613[[rule.threat.technique]]
614id = "T1105"
615name = "Ingress Tool Transfer"
616reference = "https://attack.mitre.org/techniques/T1105/"
617
618[[rule.threat.technique]]
619id = "T1219"
620name = "Remote Access Tools"
621reference = "https://attack.mitre.org/techniques/T1219/"
622[[rule.threat.technique.subtechnique]]
623id = "T1219.002"
624name = "Remote Desktop Software"
625reference = "https://attack.mitre.org/techniques/T1219/002/"
626
627
628
629[rule.threat.tactic]
630id = "TA0011"
631name = "Command and Control"
632reference = "https://attack.mitre.org/tactics/TA0011/"
633[[rule.threat]]
634framework = "MITRE ATT&CK"
635[[rule.threat.technique]]
636id = "T1218"
637name = "System Binary Proxy Execution"
638reference = "https://attack.mitre.org/techniques/T1218/"
639[[rule.threat.technique.subtechnique]]
640id = "T1218.007"
641name = "Msiexec"
642reference = "https://attack.mitre.org/techniques/T1218/007/"
643
644
645
646[rule.threat.tactic]
647id = "TA0005"
648name = "Defense Evasion"
649reference = "https://attack.mitre.org/tactics/TA0005/"