-
Detects DNS queries to commonly abused remote monitoring and management (RMM) or remote access software domains from processes that are not browsers. Intended to surface RMM clients, scripts, or other non-browser activity contacting these services.
Read More -
First Time Seen Remote Monitoring and Management Tool
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Defend Data Source: Elastic Endgame Data Source: Windows Security Event Logs Data Source: Sysmon Noise: Medium Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Rule Type: New Terms Platform: Windows ·Adversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This rule detects when a process is started whose name or code signature matches commonly abused RMM or remote access tools. New Terms type: the host.id and process.name pair has not been seen before within the configured 7-day history window.
Read More -
Identifies a newly observed RMM-related code-signature subject across the Windows Elastic Defend hosts. Attackers often use RMM tools to gain remote access to victim machines and deploy malware.
Read More -
Multiple Remote Management Tool Vendors on Same Host
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Data Source: Crowdstrike Data Source: Windows Security Event Logs Data Source: Winlogbeat Noise: Medium Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Rule Type: ES|QL Platform: Windows ·Identifies a Windows host where two or more distinct remote monitoring and management (RMM) or remote-access tool vendors are observed starting processes within the same eight-minute window. Legitimate MSP environments may run multiple tools, but this pattern can also indicate compromise, shadow IT, or attacker staging of redundant access. Processes are mapped to a single vendor label so multiple binaries from the same vendor do not inflate the count.
Read More -
Detects when the ScreenConnect client (ConnectWise Control) connects to a newly observed host server that is not the official ScreenConnect cloud. ScreenConnect is a common RMM/remote access tool abused for C2 and persistence. Self-hosted or non-standard relay servers may indicate abuse or compromise. The rule aggregates by server host (parsed from the client command line), requires first-time observation within the rule window, and limits to a single host to reduce noise.
Read More -
Quick Assist Full Control Sharing Mode Enabled
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Data Source: Windows Application Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Threat: Remote Management Tool Abuse Rule Type: Custom Query (KQL) Platform: Windows ·Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud, unauthorized remote access, or lateral movement preparation.
Read More -
Remote File Copy via TeamViewer
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Defend Data Source: SentinelOne Noise: Medium Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Rule Type: Event Correlation (EQL) Platform: Windows Resources: Osquery ·Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.
Read More -
Remote Management Access Launch After MSI Install
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Data Source: Crowdstrike Data Source: Windows Security Event Logs Data Source: Elastic Endgame Noise: Low Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Rule Type: Event Correlation (EQL) Platform: Windows ·Detects an MSI installer execution followed by the execution of commonly abused Remote Management Software like ScreenConnect. This behavior may indicate abuse where an attacker triggers an MSI install then connects via a guest link with a known session key.
Read More -
ScreenConnect Server Spawning Suspicious Processes
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Sysmon Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Threat: Web Shell Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor.
Read More -
Suspicious ScreenConnect Client Child Process
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Data Source: Windows Security Event Logs Data Source: Crowdstrike Noise: Medium Performance: Normal Profile: Recommended Threat: Remote Management Tool Abuse Threat: Living off the Land Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
Read More