Remote Access Tool Services Have Been Installed - Security

calendar Dec 21, 2023 · attack.persistence attack.t1543.003 attack.t1569.002  ·
Share on: linkedin copy

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Sigma rule (View on GitHub)

 1title: Remote Access Tool Services Have Been Installed - Security
 2id: c8b00925-926c-47e3-beea-298fd563728e
 3related:
 4    - id: 1a31b18a-f00c-4061-9900-f735b96c99fc
 5      type: similar
 6status: experimental
 7description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
 8references:
 9    - https://redcanary.com/blog/misbehaving-rats/
10author: Connor Martin, Nasreddine Bencherchali (Nextron Systems)
11date: 2022/12/23
12modified: 2023/11/15
13tags:
14    - attack.persistence
15    - attack.t1543.003
16    - attack.t1569.002
17logsource:
18    product: windows
19    service: security
20    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
21detection:
22    selection:
23        EventID: 4697
24        ServiceName|contains:
25            # Based on https://github.com/SigmaHQ/sigma/pull/2841
26            - 'AmmyyAdmin' # https://www.ammyy.com/en/
27            - 'Atera'
28            - 'BASupportExpressSrvcUpdater' # https://www.systemlookup.com/O23/6837-BASupSrvcUpdater_exe.html
29            - 'BASupportExpressStandaloneService' # https://www.systemlookup.com/O23/6839-BASupSrvc_exe.html
30            - 'chromoting'
31            - 'GoToAssist' # https://www.goto.com/it-management/resolve
32            - 'GoToMyPC' # https://get.gotomypc.com/
33            - 'jumpcloud'
34            - 'LMIGuardianSvc' # https://www.logmein.com/
35            - 'LogMeIn' # https://www.logmein.com/
36            - 'monblanking'
37            - 'Parsec'
38            - 'RManService' # https://www.systemlookup.com/O23/7855-rutserv_exe.html
39            - 'RPCPerformanceService' # https://www.remotepc.com/
40            - 'RPCService' # https://www.remotepc.com/
41            - 'SplashtopRemoteService' # https://www.splashtop.com/
42            - 'SSUService'
43            - 'TeamViewer'
44            - 'TightVNC' # https://www.tightvnc.com/
45            - 'vncserver'
46            - 'Zoho'
47    condition: selection
48falsepositives:
49    - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out
50level: medium

References

Related rules

to-top