From 4a7da063357487c9a75f659640570c63e74e9e3e Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Wed, 30 Sep 2026 16:48:50 +0200 Subject: [PATCH 01/52] New Detection Coverage for ShieldCrash Exploit --- ...e_data_stream_created_over_local_share.yml | 6 +- ...der_intermediary_artifact_was_observed.yml | 77 +++++++++++++++++++ 2 files changed, 80 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml index bd2877700b..aea125442a 100644 --- a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -1,8 +1,8 @@ name: Windows Alternate Data Stream Created Over Local Share id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 -version: 1 +version: 2 creation_date: '2026-08-19' -modification_date: '2026-08-19' +modification_date: '2026-09-30' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ data_source: search: |- `wineventlog_security` EventCode=5145 - IpAddress="127.0.0.1" + IpAddress IN ("127.0.0.1", "::1") ObjectType="File" | regex RelativeTargetName="(?i)\:\w+$" | fillnull diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml new file mode 100644 index 0000000000..64c7d7d195 --- /dev/null +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -0,0 +1,77 @@ +name: Windows Defender Intermediary Artifact Was Observed +id: 5234fb35-da15-4e45-8e17-3b7ae0e0fc9e +version: 1 +creation_date: '2026-09-30' +modification_date: '2026-09-30' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. + Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the + symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact, + its alternate data stream, and their subsequent removal. +data_source: + - Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23 +search: |- + `sysmon` + EventID IN (11, 15, 23) + process_name IN ("system","msmpeng.exe") + user=SYSTEM + AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") + | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename + dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count + by dest process_id process_name user file_name file_path + | regex file_path!="(?i)\.\w{1,10}$" + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_intermediary_artifact_was_observed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon. + These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). Make sure to update Sysmon configuration to include + directories you would like to monitor for these kinds of events. +known_false_positives: |- + Remediation of various container files, such as archives, might also lead to creation various defender artifacts + SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true + - https://socradar.io/blog/shieldcrash-poc-microsoft-defender-fix-bypass/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Intermediary artifacts [$TargetFilename$] were observed by [$process_name$] during Defender Remediation process on [$dest$] +threat_objects: + - field: TargetFilename + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 964fd332411bb16e2f62408796ef7ea0716cfe28 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Thu, 1 Oct 2026 05:55:22 -0400 Subject: [PATCH 02/52] Add New Rule Covering ResetNightmare (#4289) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_ad_user_suspicious_upn_change.yml | 91 +++++++++++++++++++ ...ws_admin_password_changed_by_non_admin.yml | 32 +++++-- 2 files changed, 115 insertions(+), 8 deletions(-) create mode 100644 detections/endpoint/windows_ad_user_suspicious_upn_change.yml diff --git a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml new file mode 100644 index 0000000000..aa955d2dd7 --- /dev/null +++ b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml @@ -0,0 +1,91 @@ +name: Windows AD User Suspicious UPN Change +id: 81324b8b-46c0-4ca3-b9a1-d33638f21021 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. + This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account. + The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464). + Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder. + A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case. +data_source: + - Windows Event Log Security 4738 +search: |- + `wineventlog_security` + EventCode=4738 + UserPrincipalName="*" + NOT UserPrincipalName IN ( + "-", + "", + "*@*", + "%%1793" + ) + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-7" + ) + NOT SubjectUserName IN ( + "ANONYMOUS*", + "NT AUTHORITY*" + ) + + | where SubjectUserSid=TargetSid + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_user_suspicious_upn_change_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: |- + Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm. +references: + - https://cravaterouge.com/articles/resetnightmare/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks +asset_type: Endpoint +cve: + - CVE-2026-27912 +mitre_attack_id: + - T1078.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 7bb99a45b9..3c8a2b17db 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -1,8 +1,8 @@ name: Windows Admin Password Changed by Non-Admin id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-09-23' author: Raven Tait, Splunk status: production type: TTP @@ -13,15 +13,27 @@ data_source: search: |- `wineventlog_security` EventCode=4723 - | rex field=object_id "-(?\d+)$" + TargetSid IN ( + "*500*", + "*512*", + "*513*", + "*518*", + "*519*", + "*520*" + ) + + | rex field=TargetSid "-(?\d+)$" | rex field=SubjectUserSid "-(?\d+)$" - | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520) + + | where tonumber(target_rid)=500 OR tonumber(target_rid) IN (512,513,518,519,520) | where tonumber(subject_rid) >= 1000 - | where SubjectUserSid != object_id + | where subject_rid != target_rid + | stats count min(_time) as firstTime max(_time) as lastTime - by dest user object_id EventCode src_user - SubjectUserSid SubjectLogonId PrivilegeList + + by dest TargetSid EventCode SubjectUserSid src_user TargetUserName + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_password_changed_by_non_admin_filter` @@ -41,17 +53,21 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. entity: field: dest type: system score: 50 +threat_objects: + - field: src_user + type: user analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint cve: - CVE-2026-33825 + - CVE-2026-27912 mitre_attack_id: - T1068 - T1543.003 From 466d5b3d88615763a22d48fac1505934e361ad43 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 1 Oct 2026 16:14:20 +0200 Subject: [PATCH 03/52] Update windows_defender_intermediary_artifact_was_observed.yml --- ...der_intermediary_artifact_was_observed.yml | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml index 64c7d7d195..a5a3a0d4e9 100644 --- a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -16,14 +16,30 @@ data_source: search: |- `sysmon` EventID IN (11, 15, 23) - process_name IN ("system","msmpeng.exe") + process_name IN ( + "System", + "msmpeng.exe" + ) user=SYSTEM - AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") - | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename - dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count - by dest process_id process_name user file_name file_path - | regex file_path!="(?i)\.\w{1,10}$" + NOT TargetFilename IN ( + "C:\\Windows\\Temp\\*", + "*:Zone.Identifier", + "*:SmartScreen" + ) + + | regex TargetFilename!="(?i)\.\w{1,10}$" + + | stats count values(EventID) as EventID + values(TargetFilename) as TargetFilename + dc(EventID) as dc_EventID + dc(TargetFilename) as dc_TargetFilename + min(_time) as firstTime + max(_time) as lastTime + + by dest process_id process_name user + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_intermediary_artifact_was_observed_filter` From 896f8d9e2fc034e0441e3c10093ad599a0e113e4 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 1 Oct 2026 07:17:01 -0700 Subject: [PATCH 04/52] Update data source TA and install.yml app versions (#4302) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/m365_copilot_graph_api.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/o365.yml | 2 +- data_sources/o365_add_app_role_assignment_grant_to_user_.yml | 2 +- .../o365_add_app_role_assignment_to_service_principal_.yml | 2 +- data_sources/o365_add_mailboxpermission.yml | 2 +- data_sources/o365_add_member_to_role_.yml | 2 +- data_sources/o365_add_owner_to_application_.yml | 2 +- data_sources/o365_add_service_principal_.yml | 2 +- data_sources/o365_change_user_license_.yml | 2 +- data_sources/o365_consent_to_application_.yml | 2 +- data_sources/o365_disable_strong_authentication_.yml | 2 +- data_sources/o365_mailitemsaccessed.yml | 2 +- data_sources/o365_modifyfolderpermissions.yml | 2 +- data_sources/o365_set_company_information_.yml | 2 +- data_sources/o365_set_mailbox.yml | 2 +- data_sources/o365_update_application_.yml | 2 +- data_sources/o365_update_authorization_policy_.yml | 2 +- data_sources/o365_update_user_.yml | 2 +- data_sources/o365_userloggedin.yml | 2 +- data_sources/o365_userloginfailed.yml | 2 +- data_sources/office_365_reporting_message_trace.yml | 2 +- data_sources/office_365_universal_audit_log.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1116.yml | 2 +- data_sources/windows_event_log_defender_1117.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4740.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_security_5441.yml | 2 +- data_sources/windows_event_log_security_5447.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 125 files changed, 125 insertions(+), 125 deletions(-) diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index eef7d37443..ab7410db47 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - appDisplayName - appId diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 749a2d3ae1..4f9bbaca4e 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 045f5a43f3..b179ee9d96 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index d7df32bf79..ecf8af19a2 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 4184acc03e..ca824bcbf3 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 1687c98ff8..00bc4805b4 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 925288235d..67062042d5 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 79d4333bbb..9c2dd48871 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index a69da205d9..bc771f7805 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index aa2db39030..a37f369403 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3b4615afa7..37c92818d4 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index d6451bc035..648a5cfcfc 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index f12ada70fd..5e89011933 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 3e75abb378..b18af0076e 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3860a0da92..ba8649b87b 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf30472105..40683dcd19 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index e40e2d4917..f73672008b 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 07dff02233..cbc4206d88 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 48912324ff..6efbb68a3b 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 0feeb95bdf..e835ce51ad 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0b264ec1b2..925465e2f7 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0402ece5bf..00c0f8fa06 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 61907c7546..bdacceddf4 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index 1c2f9ffefc..8cd1af8c3c 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index c9273ae119..1b72cc576d 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time example_log: '' diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6089a236b5..f5c6668fa1 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index b43f02de4b..77746de129 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 953e724a1e..5198777c72 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index dfbc3ae1ed..6f026135e3 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index df3d27c6c7..b5c5f36115 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7f333a78f9..6e376dc028 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index e3841b7d77..0135033e88 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 6c924b1ebb..d198bf8189 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index f72140ae8d..c6f21e79e3 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 870de7ee17..5cca95235e 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index cf70c22f8c..8b42fea335 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 592e0b6ef3..aac5be676c 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 66ada13148..d0df9f5dce 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 4c7a4f8b93..f0fc859884 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb1..8be3dfc440 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -16,7 +16,7 @@ separator_value: '1116' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_ID diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80..b7ffdd9830 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -16,7 +16,7 @@ separator_value: '1117' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_Name diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e79d991237..9c345f89e1 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ad28a09086..2944fc6126 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index db460b697e..18308e1477 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 2bbe2b2b19..43fc814187 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index ad851b6a94..4ba86029d7 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index c014f6885a..e38fadd8e0 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 88a8748b5b..ef1a010606 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 70dc254190..90d22162d6 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index f5889d38fd..59d8d06984 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 10c8ddbede..034cb376ca 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2aa8588d75..65a5a4a155 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 28d99290fb..0088b7e89f 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 38622b24f5..bb4019035a 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 060336e042..79ab58fc3e 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 75f9683746..5d3ccb17ab 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index f59cb881fd..21041873b4 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index c48507cfc3..d5dbfd0c90 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index dad4989547..6de42e817e 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 89fba03f2c..83f0397f05 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index b4667be60c..1ac6a07c6e 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index fa95daaa50..a6aad97997 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 104eb80b58..52f47aacca 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 289d62a902..f80791c7df 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 989857e278..80f51515f9 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a440f483f9..65e778bf22 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 54054afabb..0017cf0583 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3d13a756ee..3403e64193 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 4c180ca38a..bddee9b6ce 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index ed09ed27bd..310316fd12 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 4a8dfb8ca5..bf7bc7d2aa 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 5e2bbda6ab..1372f74573 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f61..5f96b26f47 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index a9cd94593d..81c019c3b4 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 9524a3f72f..ab583b54cf 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 8136745ad8..93d2716a2e 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 24032e276b..05b8d2bd41 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index ab74f07c8d..482d06ddf7 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index d73d16002d..f6cf01a48d 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index fefeeec125..7d1b7a78cd 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3fdffb89a8..803b5e8cb4 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 881d7ccf05..6241a8694e 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9c4df3de2d..4e15e78539 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 7784f95bb3..60ac157f3d 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml index f085e94675..b070516752 100644 --- a/data_sources/windows_event_log_security_4740.yml +++ b/data_sources/windows_event_log_security_4740.yml @@ -14,7 +14,7 @@ separator_value: '4740' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - action diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 1c4c800fe0..113dfdb62a 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 027458aca6..73a3e378cc 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index f02e15fa1a..17716ec455 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index dac0a891f9..cab2404af9 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 27c818f289..81bd73fe37 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index f73f48479e..a507ddf54d 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 8978d1ea3f..44d305da80 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 44102ebf15..72a021b5ab 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index f29190cc07..85f20a4617 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index bff553454a..3a247d6869 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b01e5a06bb..af76586dde 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index f8856f02cd..32ee3e86b6 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c21f93675c..ed112d8efe 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index da4093a413..4636083cdf 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 75ffcb4b33..dbe5284202 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 50d72b8dc7..f9c23c5c7c 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c021ffff6..4a93ee7e35 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index fc950fe649..29fd942c97 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 88e0dff853..d76820b4e0 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 361668dc89..f247ab52d0 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 892346a598..6bf8d9f631 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 3ed3918118..34f0f502fc 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index fe9b0aa1ac..987a9f9501 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 4ff1c91b19..f52138e52a 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 31c604a503..f5aa6f25df 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 03d0bbe1f6..a5104efd60 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index bd20531413..aa637f928a 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml index e8a62868bd..0406dee9ca 100644 --- a/data_sources/windows_event_log_security_5441.yml +++ b/data_sources/windows_event_log_security_5441.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 94e8f2a90c..d1f16649a7 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index b7298c6713..2441f3fffb 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 5b95d4b808..f386952c7d 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index b5590d7546..50059d6e56 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 2ca373f47e..7a36f05d1d 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 6cd9b92a19..ef0de6543d 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index d43588fae6..3e0518531c 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 1aa7fef426..eac759b2d8 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 31739b254e..81161d7f0d 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 6809dbf363..e429edceb1 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 521b00579b..a2adad94a8 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 27abf33af6..d846b31746 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName From c69f2137fae821fae7d712f14bdcddffd7b37e35 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 1 Oct 2026 17:31:50 +0200 Subject: [PATCH 05/52] add script and workflow for archived TAs (#4301) --- .github/workflows/archived-ta-tracker.yml | 32 +++ scripts/check_archived_tas.py | 245 ++++++++++++++++++++++ 2 files changed, 277 insertions(+) create mode 100644 .github/workflows/archived-ta-tracker.yml create mode 100644 scripts/check_archived_tas.py diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml new file mode 100644 index 0000000000..25d202bf6a --- /dev/null +++ b/.github/workflows/archived-ta-tracker.yml @@ -0,0 +1,32 @@ +name: Archived TA tracker + +on: + workflow_dispatch: + schedule: + - cron: "17 7 * * *" + +permissions: + contents: read + issues: write + +jobs: + check-archived-tas: + runs-on: ubuntu-latest + steps: + - name: Check out repository + uses: actions/checkout@v7 + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.12" + + - name: Install YAML parser + run: python -m pip install PyYAML + + - name: Create or update archived TA issues + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_REF_NAME: ${{ github.ref_name }} + run: python scripts/check_archived_tas.py diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py new file mode 100644 index 0000000000..020fa3f2d7 --- /dev/null +++ b/scripts/check_archived_tas.py @@ -0,0 +1,245 @@ +#!/usr/bin/env python3 +"""Create or refresh one GitHub issue for each archived TA in active use.""" + +from __future__ import annotations + +import json +import os +import re +import sys +import time +import urllib.error +import urllib.parse +import urllib.request +from pathlib import Path +from typing import Any + +import yaml + + +ROOT = Path(__file__).resolve().parents[1] +DATA_SOURCES_DIR = ROOT / "data_sources" +DETECTIONS_DIR = ROOT / "detections" +SPLUNKBASE_API = "https://splunkbase.splunk.com/api/v1/app" +APP_URL_PATTERN = re.compile( + r"https?://(?:www\.)?splunkbase\.splunk\.com/app/(\d+)(?:/|\b)", re.I +) +USER_AGENT = "splunk-threat-research-team/1.0" + + +def yaml_files(folder: Path): + yield from sorted(folder.rglob("*.yml")) + yield from sorted(folder.rglob("*.yaml")) + + +def load_yaml(path: Path) -> dict[str, Any] | None: + try: + value = yaml.safe_load(path.read_text(encoding="utf-8")) + except (OSError, yaml.YAMLError) as exc: + print(f"Warning: skipping {path.relative_to(ROOT)}: {exc}", file=sys.stderr) + return None + return value if isinstance(value, dict) else None + + +def discover_used_tas() -> dict[str, dict[str, Any]]: + """Return TAs grouped by app ID, including linked data sources/detections.""" + data_sources: dict[str, dict[str, Any]] = {} + for path in yaml_files(DATA_SOURCES_DIR): + obj = load_yaml(path) + if not obj or not isinstance(obj.get("name"), str): + continue + data_sources[obj["name"].strip().casefold()] = { + "name": obj["name"].strip(), + "path": path.relative_to(ROOT).as_posix(), + "supported_tas": obj.get("supported_TA") or [], + "detections": [], + } + + for path in yaml_files(DETECTIONS_DIR): + detection = load_yaml(path) + if not detection: + continue + references = detection.get("data_source") or [] + if isinstance(references, str): + references = [references] + if not isinstance(references, list): + continue + detection_name = str(detection.get("name") or path.stem) + detection_path = path.relative_to(ROOT).as_posix() + for reference in references: + if not isinstance(reference, str): + continue + source = data_sources.get(reference.strip().casefold()) + if source: + source["detections"].append({"name": detection_name, "path": detection_path}) + + tas: dict[str, dict[str, Any]] = {} + for source in data_sources.values(): + if not source["detections"]: + continue + for ta in source["supported_tas"]: + if not isinstance(ta, dict): + continue + url = str(ta.get("url") or "").strip() + match = APP_URL_PATTERN.search(url) + if not match: + continue + app_id = match.group(1) + name = str(ta.get("name") or f"Splunkbase app {app_id}").strip() + record = tas.setdefault( + app_id, + { + "app_id": app_id, + "name": name, + "url": f"https://splunkbase.splunk.com/app/{app_id}/", + "data_sources": {}, + }, + ) + if record["name"].startswith("Splunkbase app ") and name: + record["name"] = name + record["data_sources"][source["path"]] = source + return tas + + +def get_json(url: str) -> Any: + request = urllib.request.Request( + url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"} + ) + with urllib.request.urlopen(request, timeout=30) as response: + return json.loads(response.read().decode("utf-8")) + + +def truthy(value: Any) -> bool: + if isinstance(value, str): + return value.strip().casefold() in {"true", "1", "yes", "archived"} + return value is True or value == 1 + + +def splunkbase_archived(app_id: str) -> tuple[bool, str]: + url = f"{SPLUNKBASE_API}/{app_id}/" + payload = get_json(url) + if not isinstance(payload, dict): + raise ValueError("unexpected Splunkbase response") + archived = truthy(payload.get("is_archived")) or truthy(payload.get("archive_status")) + api_name = str(payload.get("title") or payload.get("name") or "").strip() + return archived, api_name + + +def github_request(method: str, url: str, token: str, body: dict[str, Any] | None = None) -> Any: + headers = { + "User-Agent": USER_AGENT, + "Accept": "application/vnd.github+json", + "Authorization": f"Bearer {token}", + "X-GitHub-Api-Version": "2022-11-28", + } + data = json.dumps(body).encode("utf-8") if body is not None else None + request = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=30) as response: + raw = response.read() + return json.loads(raw.decode("utf-8")) if raw else None + + +def list_repo_issues(repo: str, token: str) -> list[dict[str, Any]]: + """Read open and closed issues so an old issue can be reopened in place.""" + issues: list[dict[str, Any]] = [] + page = 1 + while True: + query = urllib.parse.urlencode({"state": "all", "per_page": 100, "page": page}) + payload = github_request("GET", f"https://api.github.com/repos/{repo}/issues?{query}", token) + if not isinstance(payload, list): + raise ValueError("unexpected GitHub issues response") + issues.extend(item for item in payload if isinstance(item, dict) and "pull_request" not in item) + if len(payload) < 100: + return issues + page += 1 + + +def issue_body(ta: dict[str, Any], repo: str, branch: str) -> str: + lines = [ + f"", + f"**Splunkbase TA:** [{ta['name']}]({ta['url']})", + "", + "This archived Splunkbase TA is referenced by data source objects used by detections.", + "", + "### Data source objects and detections", + ] + for source in sorted(ta["data_sources"].values(), key=lambda item: item["name"].casefold()): + source_url = f"https://github.com/{repo}/blob/{branch}/{source['path']}" + lines.append(f"- [{source['name']}]({source_url})") + detection_items = sorted(source["detections"], key=lambda item: item["name"].casefold()) + for detection in detection_items: + detection_url = f"https://github.com/{repo}/blob/{branch}/{detection['path']}" + lines.append(f" - Detection: [{detection['name']}]({detection_url})") + lines.extend(["", "_This issue is maintained automatically by the archived TA daily workflow._"]) + return "\n".join(lines) + + +def find_existing_issue(ta: dict[str, Any], issues: list[dict[str, Any]]) -> dict[str, Any] | None: + marker = f"" + marked = [issue for issue in issues if marker in str(issue.get("body") or "")] + if marked: + return next((issue for issue in marked if issue.get("state") == "open"), marked[0]) + + # Adopt a manually created issue only when its exact title and Splunkbase + # URL both match. This avoids conflating two apps that happen to share a name. + expected_title = f"{ta['name']} is archived on Splunkbase" + for issue in issues: + if issue.get("title") == expected_title and ta["url"] in str(issue.get("body") or ""): + return issue + return None + + +def main() -> int: + repo = os.environ.get("GITHUB_REPOSITORY", "").strip() + token = os.environ.get("GITHUB_TOKEN", "").strip() + branch = os.environ.get("GITHUB_REF_NAME", "develop").strip() + if not repo or not token: + print("GITHUB_REPOSITORY and GITHUB_TOKEN are required.", file=sys.stderr) + return 2 + + used_tas = discover_used_tas() + print(f"Found {len(used_tas)} distinct TAs referenced by data sources used in detections.") + issues = list_repo_issues(repo, token) + api_root = f"https://api.github.com/repos/{repo}/issues" + archived_count = 0 + + for app_id, ta in sorted(used_tas.items(), key=lambda item: item[1]["name"].casefold()): + try: + archived, api_name = splunkbase_archived(app_id) + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, ValueError, json.JSONDecodeError) as exc: + print(f"Warning: could not check Splunkbase app {app_id}: {exc}", file=sys.stderr) + continue + if not archived: + continue + archived_count += 1 + if api_name: + ta["name"] = api_name + + title = f"{ta['name']} is archived on Splunkbase" + body = issue_body(ta, repo, branch) + existing = find_existing_issue(ta, issues) + try: + if existing: + issue_number = existing["number"] + result = github_request( + "PATCH", + f"{api_root}/{issue_number}", + token, + {"title": title, "body": body, "state": "open"}, + ) + action = "Updated/reopened" + else: + result = github_request("POST", api_root, token, {"title": title, "body": body}) + action = "Created" + issues.append(result) + print(f"{action} issue #{result['number']}: {title}") + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, KeyError, TypeError) as exc: + print(f"Error: could not save issue for app {app_id}: {exc}", file=sys.stderr) + time.sleep(0.15) + + print(f"Archived TAs currently in use: {archived_count}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From cd8d8f8d98f109a151c14432c401ce7e9aa8ad7c Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 08:50:57 -0700 Subject: [PATCH 06/52] added V4 of Generic Response plan (#4295) added V4 of Generic Response plan Co-authored-by: Nasreddine Bencherchali --- response_templates/GenericIncidentResponse_v4.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 response_templates/GenericIncidentResponse_v4.json diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json new file mode 100644 index 0000000000..b2368751a9 --- /dev/null +++ b/response_templates/GenericIncidentResponse_v4.json @@ -0,0 +1 @@ +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file From dd57ea01535eff5721a6a53192e1c0a17e37bdb0 Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 12:14:27 -0700 Subject: [PATCH 07/52] Update GenericIncidentResponse_v4.json (#4308) updated from Draft to Published. --- response_templates/GenericIncidentResponse_v4.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json index b2368751a9..4d0deb9172 100644 --- a/response_templates/GenericIncidentResponse_v4.json +++ b/response_templates/GenericIncidentResponse_v4.json @@ -1 +1 @@ -{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} From 1d0d226f4c310b13cf3176c238755d54cb1a0dee Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 2 Oct 2026 02:43:32 -0700 Subject: [PATCH 08/52] Update data source TA and install.yml app versions (#4309) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- install.yml | 2 +- 63 files changed, 63 insertions(+), 63 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 6fd1fe38ab..177d51fa85 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 5ca8401b63..801a3882ea 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index f74d5622d5..e725a27c95 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 771112afc1..9ce661d969 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index a6cec23c06..87c2702b27 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 2ff6e5b714..1c5f94ecab 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 4a3d0da170..042284fe75 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index b0d5da0175..90d25a6c4b 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index d0438d39af..66946e9161 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 6a3bc6f3c0..e9c79a8b1a 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c63acbb7ec..c1153a3068 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index e66f77171f..00c450ca5d 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index c1b0c920e4..621812b8ec 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 5288b8cbd4..f84b2cf002 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 47342a57d8..bcc8f0593c 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9e8c0336a0..9c87fc438a 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index f328e4afb8..4364c10000 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 81b65bfb0d..9aa2841257 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 9dd19beb76..39d29d1a6f 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index eaaed2c844..d190093d91 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf5a76f98..bcf4fd5f84 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 8ca44cb904..6cb149284f 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 86bd7aab68..0bacc4bbb4 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 206581102a..d8aa0af29a 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 45377a711c..32a576295d 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 9f3946121a..fb8e5147f6 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index c7139fe37e..6518df5b56 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index c0350a4711..26b3ce7198 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 8b3f877fa3..f5c3a384fe 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index eaf32e0d25..95f67eb714 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 9a977502fa..888baf1d85 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 73fae76c7d..e8eb028bb9 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 0ff1b8bf84..2a0af88997 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 124ec4fdcd..bd587aed86 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index b970da776a..3d389b31f6 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 1cef1f3cee..5aa835619d 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 435cf6402e..191afb2bce 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2130bc1392..e31315d18c 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index b66fcd5be4..27e9e0b3f1 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 954e0181fb..160dfe1db5 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 7e6ef7089f..4c419b3a63 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2595753a7..d2d1b63ce6 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index d18e6de7ea..c421ba7cb9 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 8fa3955282..f3898a6679 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 82d2e09109..3613f843e8 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 5391f2dc6f..4d47df2492 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 72d8807974..1027f7c5f2 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index a2c348f7a8..4877ea119c 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 5d3dd4b85a..daa93d4c05 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 9eca348610..452914db25 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 8a52e1dd16..ebcd3e95b4 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index dae12350ea..d95a8e337f 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 3f1d2fd448..57b95d703a 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 85693fd2c7..40e4c9ae5d 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 188e83923b..83e554a5ca 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index c7bbbe699d..de9423c9c5 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 559857b474..106b623c2c 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index b9140c0c4b..f62c9e6417 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 613fcc7750..e8c6c5ae94 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a5c3a3a362..c609919c95 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 62efe79121..b165f0ace8 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.3.0 + version: 8.2.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index e6f4e5bc3d..64fc6abb3b 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - AwsAccountId diff --git a/install.yml b/install.yml index f031247a96..28ef2c7679 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.7.0 + version: 8.7.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 From f4866a01c182468c60ac9f3223fa594e0cc17a3e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 2 Oct 2026 12:09:41 +0200 Subject: [PATCH 09/52] Bump contentctl.yml and build.yml to 6.8.0 (#4311) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- .../detections}/detect_f5_tmui_rce_cve_2020_5902.yml | 4 ++-- .../detections}/linux_adding_crontab_using_list_parameter.yml | 4 ++-- .../detections}/lolbas_with_network_traffic.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) rename {detections/deprecated => removed/detections}/detect_f5_tmui_rce_cve_2020_5902.yml (97%) rename {detections/deprecated => removed/detections}/linux_adding_crontab_using_list_parameter.yml (98%) rename {detections/deprecated => removed/detections}/lolbas_with_network_traffic.yml (99%) diff --git a/build.yml b/build.yml index c3377966ae..5a6a252bb0 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.7.0 +app_version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 1ffa66afde..e6c1aceb7c 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.7.0 + version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 97% rename from detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml rename to removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml index 657033ef5a..0d8c5cdcc7 100644 --- a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml @@ -2,9 +2,9 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 version: 10 creation_date: '2020-08-04' -modification_date: '2026-08-10' +modification_date: '2026-10-02' author: Shannon Davis, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] diff --git a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml b/removed/detections/linux_adding_crontab_using_list_parameter.yml similarity index 98% rename from detections/deprecated/linux_adding_crontab_using_list_parameter.yml rename to removed/detections/linux_adding_crontab_using_list_parameter.yml index 6c550de21d..c2f250d80a 100644 --- a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml +++ b/removed/detections/linux_adding_crontab_using_list_parameter.yml @@ -2,9 +2,9 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 version: 12 creation_date: '2021-12-21' -modification_date: '2026-09-03' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: diff --git a/detections/deprecated/lolbas_with_network_traffic.yml b/removed/detections/lolbas_with_network_traffic.yml similarity index 99% rename from detections/deprecated/lolbas_with_network_traffic.yml rename to removed/detections/lolbas_with_network_traffic.yml index 0910406a7c..43a341fe4e 100644 --- a/detections/deprecated/lolbas_with_network_traffic.yml +++ b/removed/detections/lolbas_with_network_traffic.yml @@ -2,9 +2,9 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 version: 19 creation_date: '2023-02-02' -modification_date: '2026-08-24' +modification_date: '2026-10-02' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: From 3db0f548657e10f95191584270de291f55603463 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 2 Oct 2026 12:11:32 +0200 Subject: [PATCH 10/52] Deprecate Child Processes of spoolsv.exe detection (#4310) --------- Co-authored-by: Nasreddine Bencherchali --- .../child_processes_of_spoolsv_exe.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/child_processes_of_spoolsv_exe.yml (88%) diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/deprecated/child_processes_of_spoolsv_exe.yml similarity index 88% rename from detections/endpoint/child_processes_of_spoolsv_exe.yml rename to detections/deprecated/child_processes_of_spoolsv_exe.yml index 8dcc2901ae..8caf4cabe3 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/deprecated/child_processes_of_spoolsv_exe.yml @@ -1,10 +1,10 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system. data_source: @@ -57,3 +57,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. + More specific Print Spooler behaviors are covered by existing production detections. + removed_in_version: 6.10.0 + replacement_content: [] From dffaa04fc298b7097e6af54660f8f8a4d5d752ab Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:35:14 +0200 Subject: [PATCH 11/52] Update `how_to_implement` Section For NVM Content (#4281) --- ...er_spawned_unix_shell_with_external_connection.yml | 11 +++++------ ...cisco_nvm___curl_execution_with_insecure_flags.yml | 11 +++++------ ...___installation_of_typosquatted_python_package.yml | 11 +++++------ ..._or_mshta_network_execution_without_url_in_cli.yml | 11 +++++------ ...__non_network_binary_making_network_connection.yml | 11 +++++------ ...ascript_network_connection_for_a_long_duration.yml | 9 ++++----- ...o_nvm___outbound_connection_to_suspicious_port.yml | 11 +++++------ ...o_nvm___rclone_execution_with_network_activity.yml | 11 +++++------ ...dll32_abuse_of_mshtml_dll_for_payload_download.yml | 11 +++++------ ...cript_from_archive_triggering_network_activity.yml | 11 +++++------ ..._suspicious_download_from_file_sharing_website.yml | 11 +++++------ ..._suspicious_file_download_via_headless_browser.yml | 11 +++++------ ...s_network_connection_from_process_with_no_args.yml | 11 +++++------ ...picious_network_connection_initiated_via_msxsl.yml | 11 +++++------ ...us_network_connection_to_ip_lookup_service_api.yml | 11 +++++------ ...__webserver_download_from_file_sharing_website.yml | 11 +++++------ 16 files changed, 79 insertions(+), 95 deletions(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 768ff926ec..15f820549c 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 1 +version: 2 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk status: production type: Anomaly @@ -60,14 +60,13 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. references: diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4f2287fd2b..4291c2f1be 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -45,14 +45,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___curl_execution_with_insecure_flags_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Usage of these flags to reach public IPs or uncommon destinations should be reviewed. Tuning may be required for domains with known certificate issues. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 1230dc1fe3..e9d3748c20 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d -version: 5 +version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -43,14 +43,13 @@ search: | process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list | `cisco_nvm___installation_of_typosquatted_python_package_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned. known_false_positives: | False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages. diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 39f753ba7e..e2b0c93aa3 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,8 +1,8 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -48,14 +48,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior. references: diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 30d1478029..dc296fbfa2 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___non_network_binary_making_network_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication. However, such behavior is extremely uncommon and should be investigated for potential injection or abuse. diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index b30c5e3f41..1d63ae1c37 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 1 +version: 2 creation_date: '2026-09-18' -modification_date: '2026-09-18' +modification_date: '2026-09-22' author: Radka Viskova, Splunk status: production type: Anomaly @@ -46,11 +46,10 @@ search: |- how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: |- Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. references: diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 012a98db4f..4fbd80b96e 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___outbound_connection_to_suspicious_port_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools. However, many of these ports are commonly used by threat actors for reverse shells or C2 communications. diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index d707ed4745..002d7f3c79 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -52,14 +52,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rclone_execution_with_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names. references: diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 3b0f0d51b9..c8caad0967 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts. references: diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 0072fc506e..d98e0f72d8 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some software installers or automation scripts may extract and run scripts from archive files in temporary directories. However, it is uncommon for such scripts to initiate outbound network connections immediately upon extraction. diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 88bfa5cba7..2d0f030e05 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -54,14 +54,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system administrators or development teams may use tools like curl or PowerShell to download files from public services for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 7ea531ccb1..9e5dd3c33f 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -74,14 +74,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_file_download_via_headless_browser_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages. These tools may occasionally download legitimate resources as part of their normal behavior. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 30cb586fc2..f2e4760a56 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -49,14 +49,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 8fe5860f2b..e4cc59a7ea 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives may occur in development or administrative environments where msxsl.exe is used for legitimate XML transformations. However, its use is uncommon in standard user activity diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 681ce03876..c7c2ad43c3 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -53,14 +53,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Internal scripts or agents performing network checks may query IP geolocation services. Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines. diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index bdcf425a92..f1360e9e90 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___webserver_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source). However, communication to anonymous file-sharing or temporary content domains is strongly suspicious. From 9c941e6ecc2806806dcb808d1d92885f230942df Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:40:16 +0200 Subject: [PATCH 12/52] Add Missing `local=t` From Lookup Calls (#4282) --- .../azure_ad_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../cloud/circle_ci_disable_security_job.yml | 6 +- ...alls_from_previously_unseen_user_roles.yml | 6 +- ...ance_created_by_previously_unseen_user.yml | 6 +- ...ce_created_in_previously_unused_region.yml | 6 +- ...e_created_with_previously_unseen_image.yml | 6 +- ...d_with_previously_unseen_instance_type.yml | 6 +- ...nce_modified_by_previously_unseen_user.yml | 6 +- ...g_activity_from_previously_unseen_city.yml | 6 +- ...ctivity_from_previously_unseen_country.yml | 6 +- ...vity_from_previously_unseen_ip_address.yml | 6 +- ...activity_from_previously_unseen_region.yml | 6 +- .../cloud/kubernetes_nginx_ingress_lfi.yml | 6 +- .../o365_bec_email_hiding_rule_created.yml | 6 +- .../cloud/o365_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../endpoint/attacker_tools_on_endpoint.yml | 6 +- ...llation_of_typosquatted_python_package.yml | 2 +- ...outbound_connection_to_suspicious_port.yml | 2 +- .../endpoint/common_ransomware_extensions.yml | 9 +- ...tect_remote_access_software_usage_file.yml | 6 +- ..._remote_access_software_usage_fileinfo.yml | 6 +- ...t_remote_access_software_usage_process.yml | 6 +- ..._remote_access_software_usage_registry.yml | 6 +- .../first_time_seen_child_process_of_zoom.yml | 6 +- .../potential_password_in_username.yml | 6 +- ...rocesses_run_from_unexpected_locations.yml | 6 +- .../windows_ad_adminsdholder_acl_modified.yml | 6 +- ...ows_ad_dangerous_deny_acl_modification.yml | 6 +- ...ws_ad_dangerous_group_acl_modification.yml | 6 +- ...ows_ad_dangerous_user_acl_modification.yml | 6 +- ...ws_ad_dcshadow_privileges_acl_addition.yml | 18 +- ...omain_controller_audit_policy_disabled.yml | 6 +- ...ows_ad_domain_replication_acl_addition.yml | 14 +- .../windows_ad_domain_root_acl_deletion.yml | 6 +- ...indows_ad_domain_root_acl_modification.yml | 6 +- .../windows_ad_gpo_new_cse_addition.yml | 6 +- .../windows_ad_hidden_ou_creation.yml | 6 +- .../windows_ad_object_owner_updated.yml | 16 +- ...rivileged_account_sid_history_addition.yml | 6 +- ...ndows_ad_privileged_group_modification.yml | 6 +- .../windows_ad_self_dacl_assignment.yml | 18 +- .../windows_ai_platform_dns_query.yml | 6 +- .../windows_applocker_block_events.yml | 6 +- ...ege_escalation_via_unauthorized_bypass.yml | 6 +- ...ndows_attempt_to_stop_security_service.yml | 6 +- ...ial_access_from_browser_password_store.yml | 40 +- .../windows_defender_asr_audit_events.yml | 52 +- .../windows_defender_asr_block_events.yml | 56 +- ...ows_defender_asr_registry_modification.yml | 6 +- .../windows_defender_asr_rule_disabled.yml | 6 +- .../windows_defender_asr_rules_stacking.yml | 6 +- ...earch_order_hijacking_hunt_with_sysmon.yml | 6 +- ...s_domain_admin_impersonation_indicator.yml | 6 +- ...ows_dotnet_binary_in_non_standard_path.yml | 8 +- .../endpoint/windows_hosts_file_access.yml | 6 +- .../windows_identify_protocol_handlers.yml | 6 +- ...indows_important_audit_policy_disabled.yml | 6 +- ...indows_kerberos_local_successful_logon.yml | 6 +- .../windows_known_abused_dll_created.yml | 6 +- ...s_known_abused_dll_loaded_suspiciously.yml | 130 +- ...indows_lolbas_executed_as_renamed_file.yml | 6 +- ..._lolbas_executed_outside_expected_path.yml | 8 +- .../endpoint/windows_nirsoft_utilities.yml | 6 +- ...wershell_process_with_malicious_string.yml | 6 +- ...ell_script_block_with_malicious_string.yml | 6 +- .../endpoint/windows_pua_named_pipe.yml | 6 +- .../endpoint/windows_rmm_named_pipe.yml | 6 +- ...scheduled_task_with_suspicious_command.yml | 6 +- ...ws_scheduled_task_with_suspicious_name.yml | 6 +- ...e_created_with_suspicious_service_name.yml | 6 +- .../windows_suspicious_c2_named_pipe.yml | 6 +- .../windows_suspicious_named_pipe.yml | 6 +- .../windows_vulnerable_driver_installed.yml | 6 +- .../windows_vulnerable_driver_loaded.yml | 6 +- ...supply_chain_attack_network_indicators.yml | 6 +- ...e_firewall___binary_file_type_download.yml | 6 +- ...lacklisted_ssl_certificate_fingerprint.yml | 6 +- ...all___file_download_over_uncommon_port.yml | 6 +- ...___intrusion_events_by_threat_activity.yml | 8 +- ...ure_firewall___malware_file_downloaded.yml | 6 +- ...__remote_access_software_usage_traffic.yml | 6 +- ..._firewall___repeated_malware_downloads.yml | 6 +- ...connecting_to_dynamic_domain_providers.yml | 8 +- ...etect_remote_access_software_usage_dns.yml | 6 +- ...t_remote_access_software_usage_traffic.yml | 6 +- .../network/http_c2_framework_user_agent.yml | 6 +- .../network/http_malware_user_agent.yml | 6 +- detections/network/http_pua_user_agent.yml | 6 +- detections/network/http_rmm_user_agent.yml | 6 +- .../prohibited_network_traffic_allowed.yml | 6 +- ...etect_remote_access_software_usage_url.yml | 6 +- .../web/http_scripting_tool_user_agent.yml | 6 +- lookups/csv/hijacklibs_loaded.csv | 1736 ++++++++--------- macros/base64decode.yml | 6 +- ...emote_access_software_usage_exceptions.yml | 6 +- macros/suspicious_writes.yml | 6 +- 98 files changed, 1405 insertions(+), 1212 deletions(-) diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index d352b47e15..29ccd68bf8 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 16 +version: 17 creation_date: '2022-08-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -20,7 +20,7 @@ search: |- BY dest user src vendor_account vendor_product initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 7064e4b1e2..9640b9bc5d 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned to Service Principal id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41 -version: 14 +version: 15 creation_date: '2023-04-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -24,7 +24,7 @@ search: |- vendor_account vendor_product displayName initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 86c52cf751..22d5f05039 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -1,8 +1,8 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 10 +version: 11 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- | stats values(job_name) as job_names BY workflow_id workflow_name user commit_message url branch - | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job + | lookup local=t mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index eacd8e6352..ddd55187d0 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -1,8 +1,8 @@ name: Cloud API Calls From Previously Unseen User Roles id: 2181ad1f-1e73-4d0c-9780-e8880482a08f -version: 11 +version: 12 creation_date: '2020-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- All_Changes.status=success BY All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index c6b2f67045..223a8926b2 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created By Previously Unseen User id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -version: 12 +version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 1e909aad75..9d8da86c8e 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created In Previously Unused Region id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -version: 10 +version: 11 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index acb3a1e5c8..98bcc0d7b3 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Image id: bc24922d-987c-4645-b288-f8c73ec194c4 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" - | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 3ff282b40b..d627740476 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Instance Type id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -version: 11 +version: 12 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" - | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 9a90486c1b..2ff5d407c1 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Instance Modified By Previously Unseen User id: 7fb15084-b14e-405a-bd61-a6de15a40722 -version: 12 +version: 13 creation_date: '2020-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success BY All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 19fb7fd7ce..986561019d 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen City id: e7ecc5e0-88df-48b9-91af-51104c68f02f -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) - | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index b88a241026..a59431fb49 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Country id: 94994255-3acf-4213-9b3f-0494df03bb31 -version: 9 +version: 10 creation_date: '2020-12-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index c66d7cbe66..94db84a678 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen IP Address id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- All_Changes.status=success BY All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index 68b6adb810..ecd39cf37d 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Region id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 -version: 9 +version: 10 creation_date: '2020-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) - | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 93c1f49678..0cc3b3e343 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -1,14 +1,14 @@ name: Kubernetes Nginx Ingress LFI id: 0f83244b-425b-4528-83db-7a88c5f66e48 -version: 11 +version: 12 creation_date: '2021-08-23' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: TTP description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment. data_source: [] -search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 7887386766..de038e494d 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,8 +1,8 @@ name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 -version: 8 +version: 9 creation_date: '2025-02-14' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: '0xC0FFEEEE, Github Community' status: production type: TTP @@ -13,7 +13,7 @@ search: |- | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup ut_shannon_lookup word as Name + | lookup local=t ut_shannon_lookup word as Name | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval read_score=if(MarkAsRead="True", 1, 0) diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 75a8eaf325..f4680f055f 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned id: db435700-4ddc-4c23-892e-49e7525d7d39 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting. references: diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 3ccfbf7cbf..ffeaa95712 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned To Service Principal id: 80f3fc1b-705f-4080-bf08-f61bf013b900 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed. references: diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 2f1379ec50..57ab16b66d 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 19 +version: 20 creation_date: '2021-07-12' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -42,7 +42,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description + | lookup local=t attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index e9d3748c20..7784dec31a 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -21,7 +21,7 @@ search: | (process_arguments = "*poetry*" process_arguments = "*add*") ) | rex field=process_arguments "(?i)(?:pip|poetry)[^|]*?\s+(?:install|add)\s+(?P[^\s\"']+)$" - | lookup typo_squatted_python_packages + | lookup local=t typo_squatted_python_packages typosquatted_package_name as package_name OUTPUTNEW comment package_official_url | where isnotnull(comment) diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 4fbd80b96e..61d00ba116 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -33,7 +33,7 @@ search: | values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport - | lookup suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category + | lookup local=t suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category | where isnotnull(dest_port_metadata) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8f922873d4..7fb53d11a5 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,8 +1,8 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-07-02' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP @@ -56,7 +56,7 @@ search: | Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?(\.[^\.]+){1,2})$" - | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name + | lookup local=t update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name | search Name !=False | stats min(firstTime) as firstTime max(lastTime) as lastTime @@ -105,6 +105,9 @@ intermediate_findings: type: system score: 50 message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. +threat_objects: + - field: file_path + type: file_path analytic_story: - Rhysida Ransomware - Prestige Ransomware diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 6c971f45ac..0746d33835 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -40,7 +40,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` - | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 2c3579d0b6..b7e8eb806b 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- process_hash process_id process_integrity_level process_name process_path user user_id vendor_product - | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 49afb5a484..b80e1ec8b9 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -24,7 +24,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index 3d9d5dfbde..f000f5d3d4 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,15 +1,15 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 13 +version: 14 creation_date: '2024-12-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' +search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 6f88871ef2..3c4b132b75 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -1,8 +1,8 @@ name: First Time Seen Child Process of Zoom id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 11 +version: 12 creation_date: '2020-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: experimental type: Anomaly @@ -20,7 +20,7 @@ search: |- ) BY Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` - | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen + | lookup local=t zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") | `security_content_ctime(firstTime)` | `first_time_seen_child_process_of_zoom_filter` diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index e6fb5a7cbe..0664911116 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -1,8 +1,8 @@ name: Potential password in username id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 -version: 8 +version: 9 creation_date: '2022-05-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mikael Bjerkeland, Splunk status: production type: Hunting @@ -14,7 +14,7 @@ search: |- WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` - | lookup ut_shannon_lookup word AS user + | lookup local=t ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_cred=user diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 4404c793fd..34973c0d0a 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,8 +1,8 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 17 +version: 18 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile + | lookup local=t update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true | `system_processes_run_from_unexpected_locations_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9d6cd43a91..22272eb1e6 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,15 +1,15 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 11 +version: 12 creation_date: '2022-11-15' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed references: diff --git a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml index 4c843d442b..2ec0999809 100644 --- a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Deny ACL Modification id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml index 496738c80c..bb3d90f628 100644 --- a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Group ACL Modification id: 59b0fc85-7a0d-4585-97ec-06a382801990 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml index 953f11c028..efaba46b0d 100644 --- a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous User ACL Modification id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml index 961b49dc71..6722e417c5 100644 --- a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,13 +22,13 @@ search: |- | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index a9de68376c..4ae8bbf823 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Controller Audit Policy Disabled id: fc3ccef1-60a4-4239-bd66-b279511b4d14 -version: 12 +version: 13 creation_date: '2023-01-25' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -15,7 +15,7 @@ search: |- | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter` how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results within the base search. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index fa3da3a0fa..008078814a 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 14 +version: 15 creation_date: '2022-11-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,11 +22,11 @@ search: |- | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user dest user diff --git a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml index 3d8f5ea920..f4c529ed51 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Deletion id: 3cb56e57-5642-4638-907f-8dfde9afb889 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml index dd7f05a1ec..e3e9320ce7 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_modification.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Modification id: 4981e2db-1372-440d-816e-3e7e2ed74433 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml index ee01fe92ec..7ee0d8c86b 100644 --- a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml +++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml @@ -1,8 +1,8 @@ name: Windows AD GPO New CSE Addition id: 700c11d1-da09-47b2-81aa-358c143c7986 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -24,7 +24,7 @@ search: |- | \d]+\-[A-Z | \d]+\-[A-Z | \d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | lookup local=t msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [ | search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update diff --git a/detections/endpoint/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml index 753e995803..f3b1f2b8cc 100644 --- a/detections/endpoint/windows_ad_hidden_ou_creation.yml +++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml @@ -1,15 +1,15 @@ name: Windows AD Hidden OU Creation id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml index b242e6adef..d26cae513b 100644 --- a/detections/endpoint/windows_ad_object_owner_updated.yml +++ b/detections/endpoint/windows_ad_object_owner_updated.yml @@ -1,8 +1,8 @@ name: Windows AD Object Owner Updated id: 4af01f6b-d8d4-4f96-8635-758a01557130 -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -17,12 +17,12 @@ search: |- | rex field=old_value "O:(?P.*?)G:" | rex field=new_value "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user - | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group - | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user - | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` - | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | lookup local=t identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup local=t admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup local=t identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup local=t admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId BY _time ObjectClass ObjectDN diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 49124a7713..4d065865c8 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 13 +version: 14 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -16,7 +16,7 @@ search: |- NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" - | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | lookup local=t identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest diff --git a/detections/endpoint/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml index bcfe2f7cef..0feccfdd2f 100644 --- a/detections/endpoint/windows_ad_privileged_group_modification.yml +++ b/detections/endpoint/windows_ad_privileged_group_modification.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Group Modification id: 187bf937-c436-4c65-bbcb-7539ffe02da1 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -20,7 +20,7 @@ search: |- `wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc BY signature, Group_Name,src_user dest - | lookup admon_groups_def cn as Group_Name OUTPUT category + | lookup local=t admon_groups_def cn as Group_Name OUTPUT category | where category="privileged" | `windows_ad_privileged_group_modification_filter` how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details. diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml index 086f99486a..cc4b4578cd 100644 --- a/detections/endpoint/windows_ad_self_dacl_assignment.yml +++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml @@ -1,8 +1,8 @@ name: Windows AD Self DACL Assignment id: 16132445-da9f-4d03-ad44-56d717dcd67d -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -36,17 +36,17 @@ search: | | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType = coalesce(ace_type_value, aceType), aceInheritance = coalesce(ace_flag_value, "This object only"), diff --git a/detections/endpoint/windows_ai_platform_dns_query.yml b/detections/endpoint/windows_ai_platform_dns_query.yml index 60a3555327..64febb1b45 100644 --- a/detections/endpoint/windows_ai_platform_dns_query.yml +++ b/detections/endpoint/windows_ai_platform_dns_query.yml @@ -1,8 +1,8 @@ name: Windows AI Platform DNS Query id: 1ad89d24-c856-4a0e-8fdf-c20c7b9febe1 -version: 6 +version: 7 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Sysmon EventID 22 search: | `sysmon` EventCode=22 QueryName IN ("router.huggingface.co", "api.openai.com") - | lookup update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true + | lookup local=t update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true | rename dvc as dest | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id Image diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml index 35ba239a3b..e6acb3d585 100644 --- a/detections/endpoint/windows_applocker_block_events.yml +++ b/detections/endpoint/windows_applocker_block_events.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Block Events id: e369afe8-cd35-47a3-9c1e-d813efc1f7dd -version: 10 +version: 11 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- BY dest, PolicyName, RuleId, user, TargetProcessId, FilePath, FullFilePath, EventCode - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_applocker_block_events_filter` diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml index 0af315282f..15e389f058 100644 --- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml +++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Privilege Escalation via Unauthorized Bypass id: bca48629-7fa2-40d3-9e5d-807564504e28 -version: 9 +version: 10 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -18,7 +18,7 @@ search: |- FullFilePath, EventCode | where attempt_count > 5 | sort - attempt_count - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `windows_applocker_privilege_escalation_via_unauthorized_bypass_filter` how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. known_false_positives: False positives are possible if legitimate users are attempting to bypass application restrictions. This could occur if a user is attempting to run an application that is not permitted by AppLocker. It is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. Modify the threshold as needed to reduce false positives. diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index c5c5036f1f..a0612d605f 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,8 +1,8 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -29,7 +29,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup security_services_lookup service as process OUTPUTNEW category, description + | lookup local=t security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 53e4dea2ce..694b94d393 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,15 +1,42 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 23 +version: 24 creation_date: '2024-03-20' -modification_date: '2026-06-25' +modification_date: '2026-09-22' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly -description: The following analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. +description: |- + The following analytic identifies a possible non-common browser process accessing its browser user data profile. + This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. + Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. + This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 | stats count by _time object_file_path object_file_name dest process_name process_path process_id EventCode | lookup browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed | stats count min(_time) as firstTime max(_time) as lastTime values(object_file_name) values(object_file_path) values(browser_process_name) as browser_process_name by dest process_name process_path process_id EventCode isAllowed | rex field=process_name "(?[^\\\\]+)$" | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") | where isMalicious=1 and isAllowed="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_access_from_browser_password_store_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + + | stats count by _time object_file_path object_file_name + dest process_name + process_path process_id EventCode + + | lookup local=t browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(object_file_name) + values(object_file_path) + values(browser_process_name) as browser_process_name + by dest process_name process_path process_id EventCode isAllowed + + | rex field=process_name "(?[^\\\\]+)$" + | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") + | where isMalicious=1 and isAllowed="false" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credential_access_from_browser_password_store_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file. known_false_positives: The lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. Consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file. references: @@ -29,7 +56,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A non-common browser process $process_name$ accessing browser user data folder on $dest$ + message: A non-common browser process [$process_name$] accessing browser user data folder on $dest$ +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Salt Typhoon diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml index f6983833e1..ad27379523 100644 --- a/detections/endpoint/windows_defender_asr_audit_events.yml +++ b/detections/endpoint/windows_defender_asr_audit_events.yml @@ -1,33 +1,46 @@ name: Windows Defender ASR Audit Events id: 0e4d46b1-22bd-4f0e-8337-ca6f60ad4bea -version: 9 +version: 10 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. +description: |- + This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. data_source: - Windows Event Log Defender 1122 - Windows Event Log Defender 1125 - - Windows Event Log Defender 1126 - Windows Event Log Defender 1132 - Windows Event Log Defender 1134 search: |- - `ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Process_Name, Target_Commandline, - Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_audit_events_filter` + `ms_defender` + EventCode IN ( + 1122, + 1125, + 1132, + 1134 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_audit_events_filter` how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is audit only. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +55,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR audit event, $ASR_Rule$, was triggered on $dest$. + message: The ASR audit event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 8a05832e33..6d02f418c0 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -1,12 +1,14 @@ name: Windows Defender ASR Block Events id: 026f5f4e-e99f-4155-9e63-911ba587300b -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned. +description: |- + This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. + Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. data_source: - Windows Event Log Defender 1121 - Windows Event Log Defender 1126 @@ -14,20 +16,35 @@ data_source: - Windows Event Log Defender 1131 - Windows Event Log Defender 1133 search: |- - `ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Path, Parent_Commandline, - Process_Name, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_block_events_filter` -how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is block only. + `ms_defender` + EventCode IN ( + 1121, + 1126, + 1129, + 1131, + 1133 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_block_events_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +59,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR block event, $ASR_Rule$, was triggered on $dest$. + message: The ASR block event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index 627268ebe1..06c4bbcb8b 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 5007 is generated when a process attempts to modify a registry key that is related to ASR rules. This can be triggered by legitimate applications that attempt to modify registry keys that are not blocked by ASR rules. references: diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml index 29f4af1a66..eed3e8b8c5 100644 --- a/detections/endpoint/windows_defender_asr_rule_disabled.yml +++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Rule Disabled id: 429d611b-3183-49a7-b235-fc4203c4e1cb -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP description: The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives may occur if applications are typically disabling ASR rules in the environment. Monitor for changes to ASR rules to determine if this is a false positive. references: diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml index 780f6b1993..1f0d5b2928 100644 --- a/detections/endpoint/windows_defender_asr_rules_stacking.yml +++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml @@ -1,8 +1,8 @@ name: Windows Defender ASR Rules Stacking id: 425a6657-c5e4-4cbb-909e-fc9e5d326f01 -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime BY host Parent_Commandline, Process_Name, Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule + | lookup local=t asr_rules ID OUTPUT ASR_Rule | fillnull value=NULL | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index ce9a6ee981..f151287086 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -1,15 +1,15 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 -version: 12 +version: 13 creation_date: '2022-08-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' +search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup. known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index bdd740f73b..5c0981bdc1 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,8 +1,8 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: 12 +version: 13 creation_date: '2023-10-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- BY _time TargetUserName GroupMembership action app dest signature_id user vendor_product - | lookup domain_admins username as TargetUserName OUTPUT username + | lookup local=t domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter` diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index bf5c2622dd..eee16bce84 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,8 +1,8 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -45,8 +45,8 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_net_windows_file filename as process_name OUTPUT netFile - | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file filename as process_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true | `windows_dotnet_binary_in_non_standard_path_filter` how_to_implement: | diff --git a/detections/endpoint/windows_hosts_file_access.yml b/detections/endpoint/windows_hosts_file_access.yml index 04ee00db3d..accdd50bec 100644 --- a/detections/endpoint/windows_hosts_file_access.yml +++ b/detections/endpoint/windows_hosts_file_access.yml @@ -1,8 +1,8 @@ name: Windows Hosts File Access id: b34bcf35-5380-4b00-b208-5531303fb751 -version: 4 +version: 5 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,7 +29,7 @@ search: | by _time object_file_path object_file_name dest process_name process_path process_id EventCode | eval process_path = lower(process_path) - | lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path + | lookup local=t browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path | eval is_valid_browser_path=coalesce(is_valid_browser_path,"false") | where is_valid_browser_path = "false" | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index a839ad2451..e6477a71bc 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -1,8 +1,8 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 -version: 10 +version: 11 creation_date: '2022-07-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -23,7 +23,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler + | lookup local=t windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_important_audit_policy_disabled.yml b/detections/endpoint/windows_important_audit_policy_disabled.yml index b9eb4aba48..ad0f602c9e 100644 --- a/detections/endpoint/windows_important_audit_policy_disabled.yml +++ b/detections/endpoint/windows_important_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows Important Audit Policy Disabled id: 1bf500e5-1226-41d9-af5d-ed1f577929f2 -version: 8 +version: 9 creation_date: '2025-02-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- | rename ClientProcessId as process_id | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid, process_id - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_important_audit_policy_disabled_filter` how_to_implement: To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode `4719` from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f056478f50..af3fb83506 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,8 +1,8 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 15 +version: 16 creation_date: '2022-04-28' -modification_date: '2026-07-27' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -31,7 +31,7 @@ search: |- src_port status subject user user_group vendor_product - | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | lookup local=t update=true domain_controllers sAMAccountName as dest OUTPUT isDC | where isnull(isDC) | fields - isDC diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 56dbfd3b2e..e480094ba5 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,15 +1,15 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 11 +version: 12 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives. references: diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 22ae61333d..cdede1c436 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,17 +1,128 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 12 +version: 13 creation_date: '2024-04-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP -description: The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Officla Sysmon TA versions. +description: |- + The following analytic detects when DLLs with known abuse history are loaded from an unusual location. + This activity may represent an attacker performing a DLL search order or sideload hijacking technique. + These techniques are used to gain persistence as well as elevate privileges on the target system. data_source: - Sysmon EventID 7 -search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash process_id process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product loaded_file | rename Image as process | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`' -how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. -known_false_positives: DLLs being loaded by user mode programs for legitimate reasons. +search: |- + `sysmon` + ImageLoaded + EventCode=7 + + NOT ImageLoaded IN ( + "C:\\$WINDOWS.~BT\\*", + "C:\\$WinREAgent\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\SyChpe32\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemTemp\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*" + ) + + NOT ( + ImageLoaded="C:\\Windows\\Temp\\*" + Image IN ( + "C:\\Windows\\WinSxS\\arm64*", + "C:\\Windows\\UUS\\arm64\\*" + ) + Image IN ( + "*\\TiWorker.exe", + "*\\wuaucltcore.exe" + ) + ) + + NOT ( + ImageLoaded="C:\\Windows\\Microsoft.NET\\*" + ImageLoaded="*\\cscui.dll" + ) + + NOT ( + ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" + ImageLoaded="*\\version.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*" + ImageLoaded="*\\d3dx9_43.dll" + ) + + NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll" + + NOT ( + ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*" + ImageLoaded="*\\mswb7.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*" + ImageLoaded IN ( + "*\\mi.dll", + "*\\miutils.dll" + ) + ) + + NOT ( + Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" + ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" + ) + + NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*" + + NOT ( + Image IN ( + "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*", + "C:\\Windows\\System32\\backgroundTaskHost.exe" + ) + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*" + ImageLoaded="*\\wldp.dll" + ) + + NOT ( + Image IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + Image="*\\SmartConsole.exe" + ImageLoaded IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + ImageLoaded="*\\PolicyManager.dll" + ) + + | lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference + | lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded + | where islibrary="TRUE" AND excluded="false" + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest loaded_file loaded_file_path process_exec + process_guid process_hash process_id process_name + process_path service_dll_signature_exists + service_dll_signature_verified signature + signature_id user user_id reference vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_known_abused_dll_loaded_suspiciously_filter` +how_to_implement: |- + The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. +known_false_positives: |- + False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed. references: - https://attack.mitre.org/techniques/T1574/002/ - https://hijacklibs.net/api/ @@ -27,11 +138,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The module [$loaded_file$] was loaded from an unusual location. + title: The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique. entity: field: dest type: system score: 50 +threat_objects: + - field: process_path + type: file_path + - field: loaded_file_path + type: file_path analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index de0367bd26..93cd636e66 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' +search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage. references: diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index 6f917fe249..24259e1e79 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed Outside Expected Path id: 326fdf44-b90c-4d2e-adca-1fd140b10536 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -36,8 +36,8 @@ search: | Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` - | lookup lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc - | lookup lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path + | lookup local=t lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc + | lookup local=t lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path | search desc!="false" AND is_lolbas_path="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 5900bb891c..41f70c1871 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,8 +1,8 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 10 +version: 11 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -29,7 +29,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile + | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true | `windows_nirsoft_utilities_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml index b9e7b2e5fa..3093678429 100644 --- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml @@ -1,8 +1,8 @@ name: Windows PowerShell Process With Malicious String id: 5df35d50-e1a3-4a52-a337-92e69d9b1b8a -version: 9 +version: 10 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -24,7 +24,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup malicious_powershell_strings command as process + | lookup local=t malicious_powershell_strings command as process | where isnotnull(match) | `windows_powershell_process_with_malicious_string_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index bda2aaccd7..8556e4f676 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -1,15 +1,15 @@ name: Windows PowerShell Script Block With Malicious String id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d -version: 7 +version: 8 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' +search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: No false positives have been identified at this time. commands with overlap. references: diff --git a/detections/endpoint/windows_pua_named_pipe.yml b/detections/endpoint/windows_pua_named_pipe.yml index bbcf80eff0..68a592e092 100644 --- a/detections/endpoint/windows_pua_named_pipe.yml +++ b/detections/endpoint/windows_pua_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows PUA Named Pipe id: 95b11d20-e2c6-46a5-b526-8629f5f0860a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_rmm_named_pipe.yml b/detections/endpoint/windows_rmm_named_pipe.yml index 9e40b67134..fdb9a4bf18 100644 --- a/detections/endpoint/windows_rmm_named_pipe.yml +++ b/detections/endpoint/windows_rmm_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows RMM Named Pipe id: c07c7138-edf5-4a16-8b24-3842599235bf -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 8b11854703..876973cadb 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4700 - Windows Event Log Security 4702 -search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " +search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 872660b4e0..e4e43f175d 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -16,7 +16,7 @@ search: |- | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as TaskName + | lookup local=t windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml index feff939ffa..99789981a9 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml @@ -1,8 +1,8 @@ name: Windows Service Created with Suspicious Service Name id: 35eb6d19-a497-400c-93c5-645562804b11 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "") | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id - | lookup windows_suspicious_services service_name as object_name + | lookup local=t windows_suspicious_services service_name as object_name | where isnotnull(tool_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_c2_named_pipe.yml b/detections/endpoint/windows_suspicious_c2_named_pipe.yml index 270a890fcb..1654dfc0f8 100644 --- a/detections/endpoint/windows_suspicious_c2_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_c2_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious C2 Named Pipe id: 90599d85-dc2a-4d4c-8c59-9485c3665828 -version: 6 +version: 7 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_named_pipe.yml b/detections/endpoint/windows_suspicious_named_pipe.yml index c77859e3b8..38cc420561 100644 --- a/detections/endpoint/windows_suspicious_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Named Pipe id: 3a76d52f-a007-4a65-a37d-f313c2c83f31 -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path pipe_name user_id process_name signature signature_id vendor_product - | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description + | lookup local=t suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index 4884e5dd26..6f5d12c6d4 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 11 +version: 12 creation_date: '2020-01-19' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -12,7 +12,7 @@ data_source: search: |- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" | table _time dest EventCode ImagePath ServiceName ServiceType - | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description | search is_driver = TRUE | `windows_vulnerable_driver_installed_filter` how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index 8f9d32b550..26fcf996f6 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 -version: 10 +version: 11 creation_date: '2022-12-31' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -15,7 +15,7 @@ search: |- BY ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product - | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description | search is_driver = TRUE | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml index 6c02019581..946c245134 100644 --- a/detections/network/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml @@ -1,8 +1,8 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 -version: 11 +version: 12 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC + | lookup local=t 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter` how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. diff --git a/detections/network/cisco_secure_firewall___binary_file_type_download.yml b/detections/network/cisco_secure_firewall___binary_file_type_download.yml index 52fa154991..1eb6a299dd 100644 --- a/detections/network/cisco_secure_firewall___binary_file_type_download.yml +++ b/detections/network/cisco_secure_firewall___binary_file_type_download.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Binary File Type Download id: 24b2c2e3-2ff7-4a23-b814-87f8a62028cd -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ data_source: search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" FileType IN ("ISHIELD_MSI", "BINHEX", "BINARY_DATA", "ELF", "MACHO", "JARPACK", "TORRENT", "AUTORUN", "EICAR", "LNK", "SCR", "UNIX_SCRIPT") - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7103a3112f..68cbf8d274 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint id: c43f7b49-2dab-4e76-892e-7f971c2f20f1 -version: 7 +version: 8 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | `cisco_secure_firewall` EventType=* SSL_CertFingerprint=* - | lookup sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason + | lookup local=t sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason | where isnotnull(Listingreason) | stats min(_time) as firstTime max(_time) as lastTime values(dest) as dest diff --git a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml index 301f42145e..a6b4cb4e23 100644 --- a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml +++ b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - File Download Over Uncommon Port id: f26445a8-a6a2-4855-bec0-0c39e52e5b8f -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443) - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(file_name) as file_name values(uri) as uri diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml index 871d3190a6..518f8f97ff 100644 --- a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml +++ b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Intrusion Events by Threat Activity id: b71e57e8-c571-4ff1-ae13-bc4384a9e891 -version: 10 +version: 11 creation_date: '2025-05-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -40,11 +40,11 @@ data_source: search: | `cisco_secure_firewall` EventType=IntrusionEvent | stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest signature_id - | lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message + | lookup local=t cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message | where isnotnull(threat) | bin _time span=1d | stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest threat - | lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids + | lookup local=t threat_snort_count threat OUTPUT description, distinct_count_snort_ids | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app | where sig_count >= distinct_count_snort_ids | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter` diff --git a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml index c4280c0210..b32cf7b6ae 100644 --- a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml +++ b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Malware File Downloaded id: 3cc93f52-5aa6-4b7f-83b9-3430b1436813 -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 64793a40b6..8b32c0275e 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 9 +version: 10 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: | count by src ClientApplication action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description + | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description | search category IN ("remote administration", "remote desktop control") | `remote_access_software_usage_exceptions` | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` diff --git a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml index 12bf62ba6f..972b7aeb41 100644 --- a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml +++ b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Repeated Malware Downloads id: aeff2bb5-3483-48d4-9be8-c8976194be1e -version: 10 +version: 11 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | bin _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 6d14e36bc2..c3a4f069d9 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,8 +1,8 @@ name: Detect hosts connecting to dynamic domain providers id: a1e761ac-1344-4dbd-88b2-3f34c912d359 -version: 13 +version: 14 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk status: production type: TTP @@ -18,8 +18,8 @@ search: | DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` - | lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default - | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local + | lookup local=t update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default + | lookup local=t update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True | `detect_hosts_connecting_to_dynamic_domain_providers_filter` diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 1171d0c58f..dc927f67a6 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 14 +version: 15 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, + | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category | eval dest = query | search isutility = True diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 17fe2236b8..f088392075 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -30,7 +30,7 @@ search: | | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` diff --git a/detections/network/http_c2_framework_user_agent.yml b/detections/network/http_c2_framework_user_agent.yml index a442d265c5..db8c77cf01 100644 --- a/detections/network/http_c2_framework_user_agent.yml +++ b/detections/network/http_c2_framework_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP C2 Framework User Agent id: 229dc225-6abe-4d28-89fd-edf874086162 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Ravent Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description + | lookup local=t suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_malware_user_agent.yml b/detections/network/http_malware_user_agent.yml index df79a6ba05..5490fc528f 100644 --- a/detections/network/http_malware_user_agent.yml +++ b/detections/network/http_malware_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Malware User Agent id: 8c4866e4-f488-4253-8537-7dc4f954c292 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware + | lookup local=t malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware | where isnotnull(malware) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY malware url http_user_agent diff --git a/detections/network/http_pua_user_agent.yml b/detections/network/http_pua_user_agent.yml index a20df5452a..b05dd3386e 100644 --- a/detections/network/http_pua_user_agent.yml +++ b/detections/network/http_pua_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP PUA User Agent id: 21af5447-734f-4549-956b-7a255cb2b032 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool + | lookup local=t pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_rmm_user_agent.yml b/detections/network/http_rmm_user_agent.yml index dde34ab9e5..1ad50d30cb 100644 --- a/detections/network/http_rmm_user_agent.yml +++ b/detections/network/http_rmm_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP RMM User Agent id: 61884b02-0dcf-44c5-9094-db33bac09fa6 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool + | lookup local=t rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 2235c3e236..d305d4f139 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,8 +1,8 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -36,7 +36,7 @@ search: |- All_Traffic.dest_port All_Traffic.dvc All_Traffic.transport All_Traffic.vendor_product - | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | lookup local=t update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 1a8700de2a..228dd2e6a2 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` - | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference + | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index 629822d8dd..2a3328ef83 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Scripting Tool User Agent id: 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 -version: 6 +version: 7 creation_date: '2025-10-21' -modification_date: '2026-06-15' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `security_content_ctime(lastTime)` | `drop_dm_object_name(Web)` | eval http_user_agent = lower(http_user_agent) - | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool + | lookup local=t scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen diff --git a/lookups/csv/hijacklibs_loaded.csv b/lookups/csv/hijacklibs_loaded.csv index d3523b22ad..3a14253534 100644 --- a/lookups/csv/hijacklibs_loaded.csv +++ b/lookups/csv/hijacklibs_loaded.csv @@ -1,887 +1,887 @@ islibrary,library,excludes,ttp,comment -TRUE,aclui.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,aclui.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,acrodistdll.dll,*\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf +TRUE,aclui.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,aclui.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,acrodistdll.dll,*:\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf TRUE,acrodistdll.dll,*\Acrobat\acrodistdll*,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf -TRUE,activeds.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,activeds.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,applicationframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,applicationframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,appvpolicy.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,appwiz.cpl,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appwiz.cpl,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appxalluserstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxalluserstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ashldres.dll,*\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf -TRUE,atl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atltracetoolui.dll,*\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,audioses.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,audioses.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,applicationframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,applicationframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,appvpolicy.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,appwiz.cpl,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appwiz.cpl,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appxalluserstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxalluserstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ashldres.dll,*:\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf +TRUE,atl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atltracetoolui.dll,*:\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,audioses.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,audioses.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,basicnetutils.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,basicnetutils.dll,*\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,batmeter.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,batmeter.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,bcd.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcd.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcrypt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bcrypt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bderepair.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootmenuux.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootux.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cabinet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabinet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabview.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cabview.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,certcli.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certcli.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certenroll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,certenroll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cfgmgr32.dll,*\Windows\System32\*,T1574.002, -TRUE,cfgmgr32.dll,*\Windows\SysWOW64\*,T1574.002, +TRUE,basicnetutils.dll,*:\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,batmeter.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,batmeter.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,bcd.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcd.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcrypt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bcrypt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bderepair.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootmenuux.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootux.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cabinet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabinet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabview.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cabview.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,certcli.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certenroll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,certenroll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cfgmgr32.dll,*:\Windows\System32\*,T1574.002, +TRUE,cfgmgr32.dll,*:\Windows\SysWOW64\*,T1574.002, TRUE,chrome_frame_helper.dll,*\Appdata\local\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,chrome_frame_helper.dll,*\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,chrome_frame_helper.dll,*:\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ TRUE,ciscosparklauncher.dll,*\Appdata\local\CiscoSparkLauncher*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ TRUE,ciscosparklauncher.dll,*\AppData\Local\Programs\Cisco Spark\*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,classicexplorer32.dll,*\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,classicexplorer32.dll,*\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,cldapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cldapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cmutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coloradapterclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coloradapterclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,comdlg32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,comdlg32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,commfunc.dll,*\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,configmanager2.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,connect.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,connect.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,coredplus.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coremessaging.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coremessaging.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coreuicomponents.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coreuicomponents.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,credui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,credui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptsp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptsp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscobj.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscobj.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,d2d1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d2d1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,classicexplorer32.dll,*:\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,classicexplorer32.dll,*:\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,cldapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cldapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cmutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coloradapterclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coloradapterclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,comdlg32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,comdlg32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,commfunc.dll,*:\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,configmanager2.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,connect.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,connect.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,coredplus.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coremessaging.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coremessaging.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coreuicomponents.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coreuicomponents.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,credui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,credui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptsp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptsp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscobj.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscobj.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,d2d1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d2d1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Appdata\local\microsoft\teams\stage*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Microsoft\Teams\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dx9_43.dll,*\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,d3dx9_43.dll,*\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,dataexchange.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dataexchange.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgmodel.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dcntel.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,defragproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,defragproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,deviceassociation.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,deviceassociation.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicepairing.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devicepairing.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devobj.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devobj.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,directmanipulation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,directmanipulation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dismapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismcore.dll,*\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dismcore.dll,*\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dmcfgutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcfgutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcommandlineutils.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmcommandlineutils.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmenrollengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenrollengine.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenterprisediagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,drprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drvstore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,drvstore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsprop.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsprop.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsreg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsreg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxcore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxcore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxgi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxgi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dynamoapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edgeiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edgeiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edputil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edputil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,execmodelproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,execmodelproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,facesdk.dll,*\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,fastprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fastprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,faultrep.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,faultrep.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fddevquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fddevquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,feclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,feclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fhcfg.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhcfg.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhsvcctl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,flightsettings.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,flightsettings.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fltlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fltlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,formdll.dll,*\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 -TRUE,framedynos.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,framedynos.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fveapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveskybackup.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fvewiz.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fwbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsst.dll,*\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ -TRUE,fxstiff.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxstiff.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,gflagsui.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,gpapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,gpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,hha.dll,*\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hid.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hid.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hpcustpartui.dll,*\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html -TRUE,hpqhvsei.dll,*\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,httpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,httpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,icmp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,icmp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,idstore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,idstore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ieadvpack.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ieadvpack.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iernonce.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iernonce.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iertutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iertutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,ifsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,inproclogger.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsiexe.dll,*\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsiexe.dll,*\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsium.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsium.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,iumbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iumsdk.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,joinutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,joinutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,kdstub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ldvpocx.ocx,*\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox -TRUE,ldvpocx.ocx,*\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,d3dx9_43.dll,*:\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,d3dx9_43.dll,*:\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,dataexchange.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dataexchange.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgmodel.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dcntel.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,defragproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,defragproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,deviceassociation.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,deviceassociation.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicepairing.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devicepairing.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devobj.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devobj.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,directmanipulation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,directmanipulation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dismapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismcore.dll,*:\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dismcore.dll,*:\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dmcfgutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcfgutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcommandlineutils.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmcommandlineutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmenrollengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenrollengine.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenterprisediagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,drprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drvstore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,drvstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsprop.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsprop.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsreg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsreg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxcore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxgi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxgi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dynamoapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edgeiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edgeiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edputil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edputil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,execmodelproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,execmodelproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,facesdk.dll,*:\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,fastprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fastprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,faultrep.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,faultrep.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fddevquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fddevquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,feclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,feclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fhcfg.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhcfg.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhsvcctl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,flightsettings.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,flightsettings.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fltlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fltlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,formdll.dll,*:\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 +TRUE,framedynos.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,framedynos.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fveapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveskybackup.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fvewiz.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fwbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsst.dll,*:\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ +TRUE,fxstiff.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxstiff.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,gflagsui.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,gpapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,gpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,hha.dll,*:\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hid.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hid.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hpcustpartui.dll,*:\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html +TRUE,hpqhvsei.dll,*:\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,httpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,httpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,icmp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,icmp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,idstore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,idstore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ieadvpack.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ieadvpack.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iernonce.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iernonce.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iertutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iertutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,ifsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,inproclogger.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsiexe.dll,*:\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsiexe.dll,*:\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsium.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsium.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,iumbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iumsdk.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,joinutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,joinutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,kdstub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ldvpocx.ocx,*:\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,ldvpocx.ocx,*:\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox TRUE,libcares-2.dll,*\git\mingw64\*,T1574.002,https://www.trellix.com/en-au/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/ -TRUE,libvlc.dll,*\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,licensemanagerapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensemanagerapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensingdiagspp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,licensingdiagspp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,linkinfo.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,linkinfo.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,loadperf.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,loadperf.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lockdown.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 -TRUE,lockhostingframework.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,log.dll,*\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,logoncli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncontroller.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,logoncontroller.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lrwizdll.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,magnification.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,magnification.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,maintenanceui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mbaexmlparser.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mdmdiagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfc42u.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfc42u.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mintdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mozglue.dll,*\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,libvlc.dll,*:\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ +TRUE,licensemanagerapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensemanagerapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensingdiagspp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,licensingdiagspp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,linkinfo.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,linkinfo.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,loadperf.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,loadperf.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lockdown.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 +TRUE,lockhostingframework.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,log.dll,*:\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,logoncli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncontroller.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,logoncontroller.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lrwizdll.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,magnification.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,magnification.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,maintenanceui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mbaexmlparser.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mdmdiagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfc42u.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfc42u.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mintdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mozglue.dll,*:\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,mozglue.dll,*\AppData\Local\Mozilla Firefox\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mpclient.dll,*\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ +TRUE,mpclient.dll,*:\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ TRUE,mpclient.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ -TRUE,mpr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mpr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mprapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mprapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mpsvc.dll,*\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ +TRUE,mpr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mpr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mprapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mprapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mpsvc.dll,*:\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ TRUE,mpsvc.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ -TRUE,mrmcorer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mrmcorer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,msctf.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctf.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctfmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msctfmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdtctm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msftedit.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msftedit.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msutb.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msutb.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msvcp110_win.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcp110_win.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcr100.dll,*\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,msvcr100.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mswb7.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswb7.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mtxclu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mtxclu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,napinsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,napinsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ndfapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ndfapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netapi32.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netid.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netid.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netjoin.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netjoin.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netplwiz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netplwiz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netprofm.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprofm.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprovfw.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netprovfw.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netsetupapi.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netsetupapi.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netshell.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netshell.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nettrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,networkexplorer.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,networkexplorer.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,newdev.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,newdev.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlansp_c.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nlansp_c.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nshhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlanman.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlanman.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlmshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlmshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntmarta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntmarta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nvsmartmax.dll,*\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos -TRUE,oleacc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,oleacc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,opcservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,opcservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mrmcorer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mrmcorer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,msctf.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctf.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctfmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msctfmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdtctm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msftedit.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msftedit.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msutb.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msutb.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msvcp110_win.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcp110_win.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcr100.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,msvcr100.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mswb7.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswb7.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mtxclu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mtxclu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,napinsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,napinsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ndfapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ndfapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netapi32.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netid.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netid.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netjoin.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netjoin.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netplwiz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netplwiz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netprofm.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprofm.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprovfw.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netprovfw.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netsetupapi.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netsetupapi.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netshell.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netshell.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nettrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,networkexplorer.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,networkexplorer.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,newdev.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,newdev.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlansp_c.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nlansp_c.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nshhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlanman.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlanman.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlmshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlmshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntmarta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntmarta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nvsmartmax.dll,*:\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos +TRUE,oleacc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,oleacc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,opcservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,opcservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,opera_elf.dll,*\Appdata\local\programs\opera\*,T1574.002,https://twitter.com/ShitSecure/status/1566127363389329412 -TRUE,osbaseln.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osbaseln.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osksupport.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,outllib.dll,*\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,outllib.dll,*\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,p2p.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2p.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p9np.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,p9np.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pcaui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pcaui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pkeyhelper.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pla.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pla.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,playsndsrv.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,playsndsrv.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pnrpnsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pnrpnsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,policymanager.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,policymanager.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,powrprof.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,powrprof.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,printui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,printui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prntvpt.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prntvpt.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,propsys.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,propsys.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,proximitycommon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximitycommon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximityservicepal.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prvdmofcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prvdmofcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,python39.dll,*\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,osbaseln.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osbaseln.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osksupport.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,outllib.dll,*:\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,outllib.dll,*:\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,p2p.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2p.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p9np.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,p9np.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pcaui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pcaui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pkeyhelper.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pla.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pla.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,playsndsrv.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,playsndsrv.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pnrpnsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pnrpnsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,policymanager.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,policymanager.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,powrprof.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,powrprof.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,printui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,printui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prntvpt.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prntvpt.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,propsys.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,propsys.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,proximitycommon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximitycommon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximityservicepal.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prvdmofcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prvdmofcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,python39.dll,*:\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Appdata\local\Temp\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,python39.dll,*\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,python39.dll,*:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Users\anaconda3*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,qrt.dll,*\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ -TRUE,radcui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,radcui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasdlg.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasdlg.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasgcw.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasgcw.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasman.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasman.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rastls.dll,*\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf -TRUE,rcdll.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,reagent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reagent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reseteng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resetengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rjvplatform.dll,*\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rjvplatform.dll,*\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rmclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rmclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rtutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,qrt.dll,*:\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ +TRUE,radcui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,radcui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasdlg.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasdlg.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasgcw.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasgcw.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasman.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasman.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rastls.dll,*:\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf +TRUE,rcdll.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,reagent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reagent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reseteng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resetengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rjvplatform.dll,*:\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rjvplatform.dll,*:\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rmclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rmclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rtutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,rzlog4cpp_logger.dll,*\Appdata\local\razer\InGameEngine\cache\RzFpsApplet*,T1574.002,https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia -TRUE,safestore32.dll,*\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf -TRUE,samcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sapi_onecore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sapi_onecore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sas.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sas.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,security.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,security.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sensapi.dll,*\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,sensapi.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,shell32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shell32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shfolder.dll,*\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,shfolder.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,siteadv.dll,*\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf -TRUE,slc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,slc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,smadhook32c.dll,*\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,snmpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,snmpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spectrumsyncclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppcext.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sppcext.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srmtrace.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srmtrace.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssp.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sspicli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sspicli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssshim.dll,*\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,ssshim.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,staterepository.core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,staterepository.core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,structuredquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,structuredquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sxshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sxshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,symsrv.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,systemsettingsthresholdadminflowui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,textshaping.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,textshaping.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,timesync.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tmdbglog.dll,*\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ -TRUE,tosbtkbd.dll,*\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,tpmcoreprovisioning.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tpmcoreprovisioning.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tquery.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tquery.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,twext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiautomationcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiautomationcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiribbon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiribbon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,umpdc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,umpdc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,unattend.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,safestore32.dll,*:\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf +TRUE,samcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sapi_onecore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sapi_onecore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sas.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sas.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,security.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,security.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sensapi.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,sensapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,shell32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shell32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shfolder.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,shfolder.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,siteadv.dll,*:\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf +TRUE,slc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,slc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,smadhook32c.dll,*:\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,snmpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,snmpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spectrumsyncclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppcext.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sppcext.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srmtrace.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srmtrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssp.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sspicli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sspicli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssshim.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,ssshim.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,staterepository.core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,staterepository.core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,structuredquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,structuredquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sxshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sxshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,symsrv.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,systemsettingsthresholdadminflowui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,textshaping.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,textshaping.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,timesync.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tmdbglog.dll,*:\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ +TRUE,tosbtkbd.dll,*:\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,tpmcoreprovisioning.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tpmcoreprovisioning.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tquery.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tquery.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,twext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiautomationcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiautomationcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiribbon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiribbon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,umpdc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,umpdc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,unattend.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,unityplayer.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,updatepolicy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,updatepolicy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,upshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,urlmon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,urlmon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,userenv.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,userenv.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vdsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vdsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vender.dll,*\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vender.dll,*\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,version.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,version.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,virtdisk.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,virtdisk.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,upshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,urlmon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,urlmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,userenv.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,userenv.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vdsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vdsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vender.dll,*:\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vender.dll,*:\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,version.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,version.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,virtdisk.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,virtdisk.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application\*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ -TRUE,vntfxf32.dll,*\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vsodscpl.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ -TRUE,vssapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vssapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wbemprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wcmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcnnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wimgapi.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,winbio.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbio.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbrand.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winbrand.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windows.storage.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.ui.immersive.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windows.ui.immersive.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windowscodecs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecsext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowscodecsext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsperformancerecordercontrol.dll,*\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecorderui.dll,*\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,windowsudk.shellcommon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsudk.shellcommon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmde.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winrnr.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winrnr.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winscard.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winscard.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsqlite3.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsqlite3.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsync.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsync.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winutils.dll,*\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ -TRUE,wkscli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wkscli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlidprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wlidprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmiclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmidcom.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmidcom.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmpdui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wpdshext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wpdshext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wsc.dll,*\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 -TRUE,wscapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsdapi.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wsdapi.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wshbth.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshbth.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wshelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wsmsvc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsmsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wtsapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wtsapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xpsservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xpsservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xwizards.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwizards.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,vntfxf32.dll,*:\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vsodscpl.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ +TRUE,vssapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vssapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wbemprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wcmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcnnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wimgapi.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,winbio.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbio.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbrand.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winbrand.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windows.storage.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.ui.immersive.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windows.ui.immersive.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windowscodecs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecsext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowscodecsext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsperformancerecordercontrol.dll,*:\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecorderui.dll,*:\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,windowsudk.shellcommon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsudk.shellcommon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmde.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winrnr.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winrnr.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winscard.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winscard.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsqlite3.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsqlite3.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsync.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsync.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winutils.dll,*:\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ +TRUE,wkscli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wkscli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlidprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wlidprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmiclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmidcom.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmidcom.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmpdui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wpdshext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wpdshext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wsc.dll,*:\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 +TRUE,wscapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsdapi.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wsdapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wshbth.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshbth.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wshelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wsmsvc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsmsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wtsapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wtsapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xpsservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xpsservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xwizards.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwizards.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables diff --git a/macros/base64decode.yml b/macros/base64decode.yml index 99fe5b4f96..7587718114 100644 --- a/macros/base64decode.yml +++ b/macros/base64decode.yml @@ -1,10 +1,10 @@ name: base64decode id: fc2a1c3c-3251-418d-b411-7e62303e2cb3 -version: 1 +version: 2 creation_date: '2024-01-10' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation. -definition: 'eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' +definition: 'eval b64x_split=split($b64in$,"") | lookup local=t char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup local=t char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' arguments: - b64in diff --git a/macros/remote_access_software_usage_exceptions.yml b/macros/remote_access_software_usage_exceptions.yml index 882b3c7b88..adeff11e2b 100644 --- a/macros/remote_access_software_usage_exceptions.yml +++ b/macros/remote_access_software_usage_exceptions.yml @@ -1,8 +1,8 @@ name: remote_access_software_usage_exceptions id: 4b0c9d7e-6fe2-404d-87b0-80e11c9a11f1 -version: 1 +version: 2 creation_date: '2024-07-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv -definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' +definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup local=t update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup local=t remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' diff --git a/macros/suspicious_writes.yml b/macros/suspicious_writes.yml index 40c6421b8d..a86d06c69c 100644 --- a/macros/suspicious_writes.yml +++ b/macros/suspicious_writes.yml @@ -1,8 +1,8 @@ name: suspicious_writes id: 6983de37-2a08-4c42-80a2-fe404edd19b4 -version: 1 +version: 2 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: This macro limites the output to file names that have been marked as suspicious -definition: lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False +definition: lookup local=t suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False From 69bbd304ceec456a5dfecaab602e1bc4002afb1b Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Mon, 5 Oct 2026 05:59:11 -0400 Subject: [PATCH 13/52] Kerberloss Detections (#4296) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- ..._computer_spn_modified_by_user_account.yml | 96 ++++++++++++++++ ...ows_ad_spn_unicode_collision_injection.yml | 104 ++++++++++++++++++ 2 files changed, 200 insertions(+) create mode 100644 detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml create mode 100644 detections/endpoint/windows_ad_spn_unicode_collision_injection.yml diff --git a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml new file mode 100644 index 0000000000..a2fef1d15e --- /dev/null +++ b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml @@ -0,0 +1,96 @@ +name: Windows AD Computer SPN Modified By User Account +id: dbe30a35-b56d-4a7a-82c4-2433da06b342 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136. + In normal AD operations, SPN values on computer objects are managed exclusively by the computer account itself (during domain join or name change), by Domain Controllers during replication, or by the SYSTEM/NETWORK SERVICE context — all of which appear as accounts ending in the dollar sign ($) convention. + A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeLDAPDisplayName=servicePrincipalName + ObjectClass=computer + NOT SubjectUserName="*$" + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-19", + "S-1-5-20" + ) + NOT SubjectUserName IN ( + "*ANONYMOUS*", + "*NT AUTHORITY*", + "*SYSTEM" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(AttributeValue) as spn_values + values(OperationType) as operation_types + by Computer SubjectUserName SubjectDomainName SubjectUserSid ObjectDN + + | eval operation_types=mvmap(operation_types, case(operation_types="%%14675", "Deleted", operation_types="%%14674", "Added", true(), operation_types)) + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_computer_spn_modified_by_user_account_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection. + Service account provisioning workflows and some third-party identity management platforms may also legitimately modify computer SPNs. + Review the SubjectUserName, ObjectDN, and spn_values fields to determine if the change is expected. + Consider adding known administrative accounts to the filter macro. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: SubjectUserName + type: user + score: 20 + message: User [$SubjectUserName$] modified SPNs on computer object [$ObjectDN$] on $dest$ +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 + - T1558.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml new file mode 100644 index 0000000000..bc34b8c481 --- /dev/null +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -0,0 +1,104 @@ +name: Windows AD SPN Unicode Collision Injection +id: d2d2c043-57a6-4aca-be43-ebb402dbb9e5 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). + LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. + The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeValue=* + AttributeLDAPDisplayName=servicePrincipalName + OperationType IN ( + "%%14674", + "%%14675" + ) + + | regex AttributeValue="[\x{034F}\x{200B}-\x{200F}\x{00AD}\x{1806}\x{FEFF}\x{FFFC}\x{2060}\x{206A}-\x{206F}\x{180B}-\x{180D}\x{FE00}-\x{FE0F}]" + + | eval matched_invisible_chars=mvappend( + if(match(AttributeValue, "\x{034F}"), "U+034F (Combining Grapheme Joiner)", null()), + if(match(AttributeValue, "\x{200B}"), "U+200B (Zero Width Space)", null()), + if(match(AttributeValue, "\x{200C}"), "U+200C (Zero Width Non-Joiner)", null()), + if(match(AttributeValue, "\x{200D}"), "U+200D (Zero Width Joiner)", null()), + if(match(AttributeValue, "\x{200E}"), "U+200E (Left-to-Right Mark)", null()), + if(match(AttributeValue, "\x{200F}"), "U+200F (Right-to-Left Mark)", null()), + if(match(AttributeValue, "\x{00AD}"), "U+00AD (Soft Hyphen)", null()), + if(match(AttributeValue, "\x{1806}"), "U+1806 (Mongolian Todo Soft Hyphen)", null()), + if(match(AttributeValue, "\x{FEFF}"), "U+FEFF (Zero Width No-Break Space)", null()), + if(match(AttributeValue, "\x{FFFC}"), "U+FFFC (Object Replacement Character)", null()), + if(match(AttributeValue, "\x{2060}"), "U+2060 (Word Joiner)", null()), + if(match(AttributeValue, "[\x{206A}-\x{206F}]"), "U+206A-206F (Deprecated Format Characters)", null()), + if(match(AttributeValue, "[\x{180B}-\x{180D}]"), "U+180B-180D (Variation Selectors)", null()), + if(match(AttributeValue, "[\x{FE00}-\x{FE0F}]"), "U+FE00-FE0F (Variation Selectors)", null())) + + | where isnotnull(matched_invisible_chars) + | rename Computer as dest + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(matched_invisible_chars) as matched_invisible_chars + by dest SubjectUserName SubjectDomainName ObjectDN ObjectClass AttributeValue + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_spn_unicode_collision_injection_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate. + Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this. + Verify the SubjectUserName and ObjectDN to confirm intent. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] injected an invisible-Unicode SPN [$matched_invisible_chars$] onto [$ObjectDN$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: AttributeValue + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit From fb58f09f959af48f795a7532739fe268ed367392 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:14:20 +0200 Subject: [PATCH 14/52] update wmi filters analytics --- .../windows_event_log_wmi_activity_5861.yml | 61 +++++++++++++ ...ect_wmi_event_subscription_persistence.yml | 11 ++- .../wmi_temporary_event_subscription.yml | 12 ++- .../wmi_permanent_event_subscription.yml | 87 ++++++++++++++----- ..._permanent_event_subscription___sysmon.yml | 30 +++---- 5 files changed, 153 insertions(+), 48 deletions(-) create mode 100644 data_sources/windows_event_log_wmi_activity_5861.yml rename detections/{endpoint => deprecated}/detect_wmi_event_subscription_persistence.yml (89%) rename detections/{endpoint => deprecated}/wmi_temporary_event_subscription.yml (82%) diff --git a/data_sources/windows_event_log_wmi_activity_5861.yml b/data_sources/windows_event_log_wmi_activity_5861.yml new file mode 100644 index 0000000000..ab1747e351 --- /dev/null +++ b/data_sources/windows_event_log_wmi_activity_5861.yml @@ -0,0 +1,61 @@ +name: Windows Event Log WMI Activity 5861 +id: dad572ee-2271-4a1c-b118-ae6c5494a7c1 +version: 1 +creation_date: '2026-10-05' +modification_date: '2026-10-05' +author: Nasreddine Bencherchali, Splunk +description: Logs the creation of a permanent WMI event subscription when an event filter is bound to an event consumer, including consumer and filter details. +mitre_components: + - WMI Creation + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '5861' +supported_TA: [] +fields: + - _time + - Channel + - Computer + - EventCode + - System_Props_Xml + - UserData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Opcode + - ProcessID + - SystemTime + - Task + - TaskCategory + - ThreadID + - UserID + - Version + - source + - sourcetype + - user_id + - vendor_product +output_fields: + - dest +example_log: |- + 586100000x400000000000000024669Microsoft-Windows-WMI-Activity/OperationalEC2AMAZ-1QDNI6F//./root/subscriptionAtomicRedTeam_filterCommandLineEventConsumer="AtomicRedTeam_consumer"Binding EventFilter: + instance of __EventFilter + { + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + EventNamespace = "root\\subscription"; + Name = "AtomicRedTeam_filter"; + Query = "SELECT * FROM __InstanceCreationEvent Within 3 Where TargetInstance Isa \"Win32_Process\" And Targetinstance.Name = \"notepad.exe\" "; + QueryLanguage = "WQL"; + }; + Perm. Consumer: + instance of CommandLineEventConsumer + { + CommandLineTemplate = "cmd.exe"; + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + Name = "AtomicRedTeam_consumer"; + RunInteractively = FALSE; + }; + diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/deprecated/detect_wmi_event_subscription_persistence.yml similarity index 89% rename from detections/endpoint/detect_wmi_event_subscription_persistence.yml rename to detections/deprecated/detect_wmi_event_subscription_persistence.yml index 779f9b78bb..2d746625cb 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/deprecated/detect_wmi_event_subscription_persistence.yml @@ -1,10 +1,10 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-16' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. data_source: @@ -60,3 +60,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. + removed_in_version: 6.10.0 + replacement_content: + - WMI Permanent Event Subscription - Sysmon diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/deprecated/wmi_temporary_event_subscription.yml similarity index 82% rename from detections/endpoint/wmi_temporary_event_subscription.yml rename to detections/deprecated/wmi_temporary_event_subscription.yml index b08200b0fc..abe30ff297 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/deprecated/wmi_temporary_event_subscription.yml @@ -1,10 +1,10 @@ name: WMI Temporary Event Subscription id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks. data_source: [] @@ -43,3 +43,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. + Temporary WMI activity may warrant a separate behavior-focused detection. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 12a5ee8fb3..90cdca1ae4 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,43 +1,86 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 10 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: The following analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI). It leverages Sysmon EventID 5 data to identify instances where the event consumers are not the expected "NTEventLogEventConsumer." This activity is significant because it suggests an attacker is attempting to achieve persistence by running malicious scripts or binaries in response to specific system events. If confirmed malicious, this could lead to severe impacts such as data theft, ransomware deployment, or other damaging outcomes. Investigate the associated scripts or binaries to identify the source of the attack. -data_source: [] +modification_date: '2026-10-05' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. +data_source: + - Windows Event Log WMI Activity 5861 search: |- `wmi` EventCode=5861 - Binding - | rex field=Message "Consumer =\s+(?[^;|^$]+)" - | search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause + | spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER + | eval possible_cause=coalesce(possible_cause, Message) + | rex field=Message "(?i)Consumer\s*=\s*(?[^;\r\n]+)" + | eval consumer=coalesce(consumer_xml, consumer_message) + | where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?.*?)\};\s*Perm\. Consumer:" + | rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?.*?)\"\s*;" + | rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?[A-Za-z0-9_]+)\s+\{(?.*?)\};\s*\Z" + | rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?.*?)\"\s*;" + | rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?[^;]+)\s*;" + | rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?.*?)\"\s*;\s*$" + | where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer") + | eval command=coalesce(command_line_template, script_text) + | fillnull value=NULL | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName, consumer, Message + values(consumer) as consumer + values(consumer_type) as consumer_type + values(consumer_name) as consumer_name + values(command_line_template) as command_line_template + values(run_interactively) as run_interactively + values(scripting_engine) as scripting_engine + values(script_text) as script_text + values(command) as command + by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename ComputerName as dest + | rename Computer as dest | `wmi_permanent_event_subscription_filter` -how_to_implement: To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. -references: [] -finding: - title: WMI Permanent Event Subscription detected on $dest$ - entity: - field: dest - type: system - score: 50 +how_to_implement: |- + Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available. + The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details. +known_false_positives: |- + Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro. +references: + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: WMI event filter [$filter_name$] in [$filter_event_namespace$] watches [$filter_query$] and is bound to [$consumer_type$] [$consumer_name$] on [$dest$], which can execute [$command$]. +threat_objects: + - field: command + type: command analytic_story: - Suspicious WMI Use asset_type: Endpoint mitre_attack_id: - - T1047 + - T1546.003 product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud category: endpoint security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team_wmi_subscription/wmi.log + source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index f876f349a2..5408d149b8 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,28 +1,24 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 12 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk status: production -type: TTP -description: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. +type: Anomaly +description: |- + Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 + `sysmon` EventCode=21 Operation=Created | stats count min(_time) as firstTime max(_time) as lastTime - BY dest dvc object - object_attrs object_category object_path - signature signature_id src - status user user_id - vendor_product Consumer ConsumerNoQuotes - Filter FilterNoQuotes + BY dest user Consumer Filter | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. +how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. +known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ @@ -37,18 +33,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: WMI Permanent Event Subscription detected on $dest$ by $user$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: WMI Permanent Event Subscription detected on $dest$ by $user$ + message: A WMI consumer-to-filter binding was on [$dest$] by [$user$] consumer - [$Consumer$] was bound to filter [$Filter$]. analytic_story: - Suspicious WMI Use asset_type: Endpoint From d032dd9e71ed9e3a4888e9e31a85aa00341e1f82 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:17:14 +0200 Subject: [PATCH 15/52] Update wmi_permanent_event_subscription___sysmon.yml --- ..._permanent_event_subscription___sysmon.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 5408d149b8..9a6f4e32e1 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,18 +7,25 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. + Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 Operation=Created - | stats count min(_time) as firstTime max(_time) as lastTime + `sysmon` + EventCode=21 + Operation=Created + + | stats count min(_time) as firstTime + max(_time) as lastTime BY dest user Consumer Filter - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. -known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wmi_permanent_event_subscription___sysmon_filter` +how_to_implement: |- + To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. +known_false_positives: |- + Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ From 152e2f57cd28a9792d4329e3f7de3775656665dc Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:20:42 +0200 Subject: [PATCH 16/52] New Approach on Handling Renamed Binaries (#4283) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_html_help_renamed.yml | 11 +- .../detect_mshta_renamed.yml | 11 +- .../detect_renamed_7_zip.yml | 11 +- .../detect_renamed_psexec.yml | 11 +- .../detect_renamed_rclone.yml | 11 +- .../detect_renamed_winrar.yml | 11 +- ...ous_microsoft_workflow_compiler_rename.yml | 11 +- .../suspicious_msbuild_rename.yml | 11 +- ...indows_lolbas_executed_as_renamed_file.yml | 9 +- .../windows_regsvr32_renamed_binary.yml | 11 +- .../windows_renamed_powershell_execution.yml | 11 +- ...named_command_interpreter_was_executed.yml | 109 +++++++++++++ ...ows_renamed_lolbas_binary_was_executed.yml | 114 ++++++++++++++ ...opular_3rd_party_software_was_executed.yml | 107 +++++++++++++ ...ows_renamed_python_binary_was_executed.yml | 91 +++++++++++ lookups/csv/renamed_lolbas_binaries.csv | 147 ++++++++++++++++++ lookups/csv/renamed_lolbas_binaries.yml | 14 ++ .../renamed_popular_3rd_party_binaries.csv | 43 +++++ .../renamed_popular_3rd_party_binaries.yml | 14 ++ ...d_windows_command_interpreter_binaries.csv | 14 ++ ...d_windows_command_interpreter_binaries.yml | 14 ++ 21 files changed, 754 insertions(+), 32 deletions(-) rename detections/{endpoint => deprecated}/detect_html_help_renamed.yml (89%) rename detections/{endpoint => deprecated}/detect_mshta_renamed.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_7_zip.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_psexec.yml (89%) rename detections/{endpoint => deprecated}/detect_renamed_rclone.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_winrar.yml (87%) rename detections/{endpoint => deprecated}/suspicious_microsoft_workflow_compiler_rename.yml (89%) rename detections/{endpoint => deprecated}/suspicious_msbuild_rename.yml (89%) rename detections/{endpoint => deprecated}/windows_lolbas_executed_as_renamed_file.yml (95%) rename detections/{endpoint => deprecated}/windows_regsvr32_renamed_binary.yml (90%) rename detections/{endpoint => deprecated}/windows_renamed_powershell_execution.yml (91%) create mode 100644 detections/endpoint/windows_renamed_command_interpreter_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_python_binary_was_executed.yml create mode 100644 lookups/csv/renamed_lolbas_binaries.csv create mode 100644 lookups/csv/renamed_lolbas_binaries.yml create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.csv create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.yml create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.csv create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.yml diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/deprecated/detect_html_help_renamed.yml similarity index 89% rename from detections/endpoint/detect_html_help_renamed.yml rename to detections/deprecated/detect_html_help_renamed.yml index e9d228305a..6a71fb8028 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/deprecated/detect_html_help_renamed.yml @@ -1,10 +1,10 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 14 +version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk. data_source: @@ -53,3 +53,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/deprecated/detect_mshta_renamed.yml similarity index 88% rename from detections/endpoint/detect_mshta_renamed.yml rename to detections/deprecated/detect_mshta_renamed.yml index e04f4d7434..a18668a17f 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/deprecated/detect_mshta_renamed.yml @@ -1,10 +1,10 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 13 +version: 14 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/deprecated/detect_renamed_7_zip.yml similarity index 88% rename from detections/endpoint/detect_renamed_7_zip.yml rename to detections/deprecated/detect_renamed_7_zip.yml index 667a8ad2f5..fea1e5e5ce 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/deprecated/detect_renamed_7_zip.yml @@ -1,10 +1,10 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/deprecated/detect_renamed_psexec.yml similarity index 89% rename from detections/endpoint/detect_renamed_psexec.yml rename to detections/deprecated/detect_renamed_psexec.yml index 2e56a88379..52e1bdf889 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/deprecated/detect_renamed_psexec.yml @@ -1,10 +1,10 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 17 +version: 18 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk, Alex Oberkircher, Github Community -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network. data_source: @@ -67,3 +67,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/deprecated/detect_renamed_rclone.yml similarity index 88% rename from detections/endpoint/detect_renamed_rclone.yml rename to detections/deprecated/detect_renamed_rclone.yml index d7bbfa5d71..7e9bccd333 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/deprecated/detect_renamed_rclone.yml @@ -1,10 +1,10 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/deprecated/detect_renamed_winrar.yml similarity index 87% rename from detections/endpoint/detect_renamed_winrar.yml rename to detections/deprecated/detect_renamed_winrar.yml index 5779de2a81..215d1d0a53 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/deprecated/detect_renamed_winrar.yml @@ -1,10 +1,10 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 16 +version: 17 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml similarity index 89% rename from detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml rename to detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml index 21f34aefa8..ec137b5b28 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,10 +1,10 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/deprecated/suspicious_msbuild_rename.yml similarity index 89% rename from detections/endpoint/suspicious_msbuild_rename.yml rename to detections/deprecated/suspicious_msbuild_rename.yml index 7a4091f310..4fb2bbb641 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/deprecated/suspicious_msbuild_rename.yml @@ -1,10 +1,10 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -58,3 +58,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml similarity index 95% rename from detections/endpoint/windows_lolbas_executed_as_renamed_file.yml rename to detections/deprecated/windows_lolbas_executed_as_renamed_file.yml index 93cd636e66..94d1538a1a 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml @@ -2,9 +2,9 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 version: 11 creation_date: '2024-05-03' -modification_date: '2026-09-22' +modification_date: '2026-09-23' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. data_source: @@ -63,3 +63,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to renaming of its newer version. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/deprecated/windows_regsvr32_renamed_binary.yml similarity index 90% rename from detections/endpoint/windows_regsvr32_renamed_binary.yml rename to detections/deprecated/windows_regsvr32_renamed_binary.yml index 883a47c7e4..4d6940c412 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/deprecated/windows_regsvr32_renamed_binary.yml @@ -1,10 +1,10 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 13 +version: 14 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment. data_source: @@ -65,3 +65,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_renamed_powershell_execution.yml b/detections/deprecated/windows_renamed_powershell_execution.yml similarity index 91% rename from detections/endpoint/windows_renamed_powershell_execution.yml rename to detections/deprecated/windows_renamed_powershell_execution.yml index bade4e80af..dbb8ef8e18 100644 --- a/detections/endpoint/windows_renamed_powershell_execution.yml +++ b/detections/deprecated/windows_renamed_powershell_execution.yml @@ -1,10 +1,10 @@ name: Windows Renamed Powershell Execution id: c08014de-cc5a-42de-9775-76ecd5b37bbd -version: 8 +version: 9 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments. data_source: @@ -49,3 +49,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml new file mode 100644 index 0000000000..3e97a3ea43 --- /dev/null +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -0,0 +1,109 @@ +name: Windows Renamed Command Interpreter was Executed +id: 6f4611be-076e-4fa8-bc78-466588a71442 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_command_interpreter_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Command Interpreter [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Suspicious Command-Line Executions + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml new file mode 100644 index 0000000000..f0842c81eb --- /dev/null +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -0,0 +1,114 @@ +name: Windows Renamed LOLBAS Binary was Executed +id: 10c3850e-810d-41b4-a197-2f14d7883579 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Steven Dick, Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + NOT process_name IN ( + "excelcnv.exe", + "installutil64.exe", + "protoc~1.exe", + "regwrite.exe", + "vzshadow.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_lolbas_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS utility [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml new file mode 100644 index 0000000000..374458d818 --- /dev/null +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -0,0 +1,107 @@ +name: Windows Renamed Popular 3rd Party Software was Executed +id: cf6713c7-ac6b-4963-83a6-39f24ed10aa8 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_popular_3rd_party_software_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries might have overlapping executable names. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ + - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Windows 3rd Party software [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml new file mode 100644 index 0000000000..4f0731c451 --- /dev/null +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -0,0 +1,91 @@ +name: Windows Renamed Python Binary was Executed +id: 6735153f-2da0-4eba-a428-288898613837 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Python process being executed where it's process name does not match + it's original file name attribute. Processes that have been renamed and executed may be an indicator that + an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime + FROM datamodel=Endpoint.Processes + WHERE + Processes.original_file_name IN ( + "py*", + "python*", + "ipyw*" + ) + NOT Processes.original_file_name IN ("-","unknown") + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_python_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: Various Python implementations might have a different executable name, which could trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/006/ + - https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Python binary [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/lookups/csv/renamed_lolbas_binaries.csv b/lookups/csv/renamed_lolbas_binaries.csv new file mode 100644 index 0000000000..ba83e577f1 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.csv @@ -0,0 +1,147 @@ +original_file_name,description +acccheckconsole.exe,Verifies UI accessibility requirements +addinutil.exe,.NET Tool used for updating cache files for Microsoft Office Add-Ins. +adplus.exe,Debugging tool included with Windows Debugging Tools +agentexecutor.exe,Intune Management Extension included on Intune Managed Devices +appcert.exe,Windows App Certification Kit command-line tool. +appinstaller.exe,Tool used for installation of AppX/MSIX applications on Windows 10 +appvlp.exe,Application Virtualization Utility Included with Microsoft Office 2016 +aspnet_compiler.exe,ASP.NET Compilation Tool +at.exe,Schedule periodic tasks +atbroker.exe,Helper binary for Assistive Technology (AT) +bitsadmin.exe,Used for managing background intelligent transfer +cdb.exe,Debugging tool included with Windows Debugging Tools. +certoc.exe,Used for installing certificates +certreq.exe,Used for requesting and managing certificates +certutil.exe,Windows binary used for handling certificates +cmdkey.exe,"creates, lists, and deletes stored user names and passwords or credentials." +cmdl32.exe,Microsoft Connection Manager Auto-Download +cmstp.exe,Installs or removes a Connection Manager service profile. +colorcpl.exe,Binary that handles color management +conhost.exe,Console Window host +control.exe,Console Window host +csc.exe,Binary file used by .NET to compile C# code +cscript.exe,Binary used to execute scripts in Windows +csi.exe,Command line interface included with Visual Studio. +curl.exe,Used for transferring data to or from a server; bundled with Windows 10 1803+ and can be used to download or upload files (not in repo lookup - added manually) +customshellhost.exe,A host process that is used by custom shells when using Windows in Kiosk mode. +datasvcutil.exe,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. +desktopimgdownldr.exe,Windows binary used to configure lockscreen/desktop image +devicecredentialdeployment.exe,Device Credential Deployment +devinit.exe,Visual Studio 2019 tool +devtoolslauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +dfsvc.exe,ClickOnce engine in Windows used by .NET +diantz.exe,Binary that package existing files into a cabinet (.cab) file +diskshadow.exe,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). +dnscmd.exe,A command-line interface for managing DNS servers +dotnet.exe,dotnet.exe comes with .NET Framework +dsdbutil.exe,Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. +dumpminitool.exe,Dump tool part Visual Studio 2022 +dxcap.exe,DirectX diagnostics/debugger included with Visual Studio. +esentutl.exe,Binary for working with Microsoft Joint Engine Technology (JET) database +eventvwr.exe,Displays Windows Event Logs in a GUI window. +excel.exe,Microsoft Office binary +expand.exe,Binary that expands one or more compressed files +extexport.exe,Load a DLL located in the C:\test folder with a specific name. +extrac32.exe,"Extract to ADS, copy or overwrite a file with Extrac32.exe" +findstr.exe,"Write to ADS, discover, or download files with Findstr.exe" +finger.exe,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon +fltmc.exe,Filter Manager Control Program used by Windows +forfiles.exe,Selects and executes a command on a file or set of files. This command is useful for batch processing. +fsi.exe,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. +fsianycpu.exe,32/64-bit FSharp (F#) Interpreter included with Visual Studio. +fsutil.exe,File System Utility +ftp.exe,A binary designed for connecting to FTP servers +gfxdownloadwrapper.exe,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path." +gpscript.exe,Used by group policy to process scripts +hh.exe,Binary used for processing chm files in Windows +ie4uinit.exe,Executes commands from a specially prepared ie4uinit.inf file. +iediagcmd.exe,Diagnostics Utility for Internet Explorer +ieexec.exe,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. +ilasm.exe,used for compile c# code into dll or exe. +imewdbld.exe,Microsoft IME Open Extended Dictionary Module +infdefaultinstall.exe,Binary used to perform installation based on content inside inf files +installutil.exe,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies +jsc.exe,Binary file used by .NET to compile javascript code to .exe or .dll format +ldifde.exe,"Creates, modifies, and deletes LDAP directory objects." +makecab.exe,Binary to package existing files into a cabinet (.cab) file +manage-bde.wsf,Script for managing BitLocker +mavinject.exe,Used by App-v in Windows +mftrace.exe,Trace log generation tool for Media Foundation Tools. +microsoft.nodejstools.pressanykey.exe,Part of the NodeJS Visual Studio tools. +microsoft.workflow.compiler.exe,A utility included with .NET that is capable of compiling and executing C# or VB.net code. +mmc.exe,Load snap-ins to locally and remotely manage Windows systems +msaccess.exe,Microsoft Office binary +msbuild.exe,Used to compile and execute code +msconfig.exe,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows" +msdeploy.exe,Microsoft tool used to deploy Web Applications. +msdt.exe,Microsoft diagnostics tool +mshta.exe,Used by Windows to execute html applications. (.hta) +msiexec.exe,Used by Windows to execute msi files +msohtmed.exe,Microsoft Office binary +mspub.exe,Microsoft Office binary +netsh.exe,Netsh is a Windows tool used to manipulate network interface settings. +ntdsutil.exe,Command line utility used to export Active Directory. +odbcconf.exe,Used in Windows for managing ODBC connections +offlinescannershell.exe,Windows Defender Offline Shell +pcalua.exe,Program Compatibility Assistant +pcwrun.exe,Program Compatibility Wizard +pktmon.exe,Capture Network Packets on the windows 10 with October 2018 Update or later. +pnputil.exe,Used for installing drivers +powerpnt.exe,Microsoft Office binary +presentationhost.exe,File is used for executing Browser applications +print.exe,Used by Windows to send files to the printer +printbrm.exe,Printer Migration Command-Line Tool +protocolhandler.exe,Microsoft Office binary +provlaunch.exe,Launcher process +psr.exe,"Windows Problem Steps Recorder, used to record screen and clicks." +rasautou.exe,Windows Remote Access Dialer +rdrleakdiag.exe,Microsoft Windows resource leak diagnostic tool +reg.exe,Used to manipulate the registry +regasm.exe,Part of .NET +regedit.exe,Used by Windows to manipulate registry +regini.exe,Used to manipulate the registry +register-cimprovider.exe,Used to register new wmi providers +regsvcs.exe,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies +regsvr32.exe,Used by Windows to register dlls +replace.exe,Used to replace file with another file +rpcping.exe,Used to verify rpc connection +rundll32.exe,Used by Windows to execute dll files +runexehelper.exe,Launcher process +runonce.exe,Executes a Run Once Task that has been configured in the registry +sc.exe,Used by Windows to manage services +schtasks.exe,Schedule periodic tasks +scriptrunner.exe,Execute binary through proxy binary to evade defensive counter measures +setres.exe,Configures display settings +settingsynchost.exe,Host Process for Setting Synchronization +sqldumper.exe,Debugging utility included with Microsoft SQL. +sqlps.exe,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons." +sqltoolsps.exe,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. +stordiag.exe,Storage diagnostic tool +syncappvpublishingserver.exe,Used by App-v to get App-v server lists +tar.exe,Used by Windows to extract and create archives. +testwindowremoteagent.exe,TestWindowRemoteAgent.exe is the command-line tool to establish RPC +ttdinject.exe,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) +tttracer.exe,Used by Windows 1809 and newer to Debug Time Travel +unregmp2.exe,Microsoft Windows Media Player Setup Utility +vbc.exe,Binary file used for compile vbs code +verclsid.exe,Used to verify a COM object before it is instantiated by Windows Explorer +visualuiaverifynative.exe,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. +vsdiagnostics.exe,Command-line tool used for performing diagnostics. +vshadow.exe,VShadow is a command-line tool that can be used to create and manage volume shadow copies. +vsiisexelauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +vsjitdebugger.exe,Just-In-Time (JIT) debugger included with Visual Studio +vsls-agent.exe,Agent for Visual Studio Live Share (Code Collaboration) +vstest.console.exe,VSTest.Console.exe is the command-line tool to run tests +wab.exe,Windows address book manager +wbadmin.exe,Windows Backup Administration utility +wfc.exe,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). +winproj.exe,Microsoft Project Executable +winword.exe,Microsoft Office binary +wlrmdr.exe,Windows Logon Reminder executable +wmic.exe,The WMI command-line (WMIC) utility provides a command-line interface for WMI +workfolders.exe,Work Folders +wscript.exe,Used by Windows to execute scripts +wsreset.exe,Used to reset Windows Store settings according to its manifest file +wuauclt.exe,Windows Update Client +xwizard.exe,Execute custom class that has been added to the registry or download a file with Xwizard.exe diff --git a/lookups/csv/renamed_lolbas_binaries.yml b/lookups/csv/renamed_lolbas_binaries.yml new file mode 100644 index 0000000000..e76d3c3169 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_lolbas_binaries +id: 8fcee872-392f-41ab-95fb-a50f8557b03e +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of LOLBAS binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.csv b/lookups/csv/renamed_popular_3rd_party_binaries.csv new file mode 100644 index 0000000000..d2a52926d0 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.csv @@ -0,0 +1,43 @@ +original_file_name,description +7z.exe,7-Zip +7zg.exe,7-Zip +7zfm.exe,7-Zip +7za.exe,7-Zip +winrar*.exe,WinRAR +rar.exe,WinRAR +unrar.exe,WinRAR +peazip.exe,PeaZip +anydesk.exe,AnyDesk +teamviewer*.exe,TeamViewer +tv_w32.exe,TeamViewer +tv_x64.exe,TeamViewer +screenconnect*.exe,ConnectWise ScreenConnect +ateraagent.exe,Atera +srserver.exe,Splashtop +splashtopstreamer.exe,Splashtop +lmiguardiansvc.exe,LogMeIn +logmein.exe,LogMeIn +basupsrvc.exe,N-able Take Control +tcclient.exe,N-able Take Control +action1_agent.exe,Action1 +rutserv.exe,Remote Utilities +rfusclient.exe,Remote Utilities +advanced_ip_scanner*.exe,Advanced IP Scanner +advanced_port_scanner*.exe,Advanced Port Scanner +netscan.exe,SoftPerfect Network Scanner +ipscan.exe,Angry IP Scanner +adfind*.exe,AdFind +processhacker.exe,Process Hacker +systeminformer.exe,System Informer +winscp*.exe,WinSCP +rclone.exe,Rclone +plink.exe,PuTTY +putty*.exe,PuTTY +mobaxterm.exe,MobaXterm +ngrok.exe,Ngrok +cloudflared.exe,Cloudflared +chisel.exe,Chisel +webbrowserpassview.exe,NirSoft WebBrowserPassView +mailpv.exe,NirSoft Mail PassView +autoit3.exe,AutoIt +aut2exe.exe,AutoIt diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.yml b/lookups/csv/renamed_popular_3rd_party_binaries.yml new file mode 100644 index 0000000000..0c684fe5e1 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_popular_3rd_party_binaries +id: 83a56371-0a0f-4486-be21-8dc1d4d25e97 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of popular 3rd party Windows binaries and their software names +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.csv b/lookups/csv/renamed_windows_command_interpreter_binaries.csv new file mode 100644 index 0000000000..8809169991 --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.csv @@ -0,0 +1,14 @@ +original_file_name,description +bash.exe,"Bourne Again Shell interpreter; ships with WSL/Git for Windows/Cygwin and executes shell scripts and commands." +cmd.exe,"The native Windows command-line interpreter used to execute batch scripts and commands." +powershell.exe,"Windows PowerShell (v5.1 and earlier) command-line shell and scripting engine, heavily used for administration and living-off-the-land attacks." +powershell_ise.exe,"PowerShell Integrated Scripting Environment; GUI host for writing and running PowerShell scripts." +psexec*.c,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec*.exe,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec64.exe,"64-bit build of the Sysinternals PsExec remote execution tool." +pwsh.exe,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +pwsh.dll,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +sh.exe,"POSIX-compatible shell interpreter, typically bundled with Git for Windows/WSL/Cygwin, used to run shell scripts." +windowsterminal.exe,"Modern Windows Terminal application host that runs command-line shells (cmd, PowerShell, WSL) in tabs." +wsl.exe,"Windows Subsystem for Linux launcher; runs a Linux distribution/shell and executes Linux binaries or scripts on Windows." +wt.exe,"Windows Terminal executable, invoked via the wt command; launches and hosts terminal shell sessions." diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.yml b/lookups/csv/renamed_windows_command_interpreter_binaries.yml new file mode 100644 index 0000000000..0e364ef511 --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_windows_command_interpreter_binaries +id: 2517d9fc-a1ee-4303-9a5b-15eaee7f418b +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Windows command interpreter binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false From 3115df76912b73f367d295247e4c8dc21f46dcba Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:23:50 +0200 Subject: [PATCH 17/52] version update --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- .../endpoint/wmi_permanent_event_subscription___sysmon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 90cdca1ae4..0455b9c92d 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 15 +version: 11 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9a6f4e32e1..9b6796c2b9 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 14 +version: 13 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk From ec66842b10a7486f7c1488ff35bdcb9f1613b68e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:47:45 +0200 Subject: [PATCH 18/52] Update wmi_permanent_event_subscription___sysmon.yml --- .../wmi_permanent_event_subscription___sysmon.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9b6796c2b9..605bf5d24e 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,13 +7,17 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. + Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- `sysmon` EventCode=21 - Operation=Created + Operation IN ( + Created, + Deleted, + Modified + ) | stats count min(_time) as firstTime max(_time) as lastTime From 2e906db303c44feed2f00040a80a8e43e2ef3def Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 15:52:28 +0200 Subject: [PATCH 19/52] Update detections/endpoint/wmi_permanent_event_subscription.yml Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 0455b9c92d..367735a71c 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -7,7 +7,7 @@ author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: |- - Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. + Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes. data_source: - Windows Event Log WMI Activity 5861 search: |- From 0443d7b68535009c433b6534437d3c89b726f2da Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 19:09:52 +0200 Subject: [PATCH 20/52] Apply codex reviews (#4317) --- .github/workflows/archived-ta-tracker.yml | 2 +- .../endpoint/windows_admin_password_changed_by_non_admin.yml | 2 +- .../endpoint/windows_renamed_lolbas_binary_was_executed.yml | 2 +- scripts/check_archived_tas.py | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml index 25d202bf6a..0f45898107 100644 --- a/.github/workflows/archived-ta-tracker.yml +++ b/.github/workflows/archived-ta-tracker.yml @@ -22,7 +22,7 @@ jobs: python-version: "3.12" - name: Install YAML parser - run: python -m pip install PyYAML + run: python -m pip install PyYAML==6.0.3 - name: Create or update archived TA issues env: diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 3c8a2b17db..1d6ad8ec27 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -53,7 +53,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$TargetUserName$] on $dest$. entity: field: dest type: system diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index f0842c81eb..2569bb5995 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -31,7 +31,7 @@ search: |- | rename original_file_name as Processes.process_name | table Processes.process_name ] - NOT process_name IN ( + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", "protoc~1.exe", diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index 020fa3f2d7..a3b433e070 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -56,6 +56,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: } for path in yaml_files(DETECTIONS_DIR): + if (DETECTIONS_DIR / "deprecated") in path.parents: + continue detection = load_yaml(path) if not detection: continue From ce03ed3086dc4249ffe060a23802853da4a13c2c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 12:00:23 +0200 Subject: [PATCH 21/52] More Codex Fixes (#4318) --- ...azure_ad_user_consent_blocked_for_risky_application.yml | 2 +- .../windows_renamed_command_interpreter_was_executed.yml | 7 +++---- .../windows_renamed_lolbas_binary_was_executed.yml | 7 +++---- ...ows_renamed_popular_3rd_party_software_was_executed.yml | 7 +++---- 4 files changed, 10 insertions(+), 13 deletions(-) diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 9fc6cc7550..34fb99e3ae 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -24,7 +24,7 @@ search: |- | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) - | search reason = "Risky application detected" + | search reason = "\"Risky application detected\"" | rex field=permissions "Scope: (?[^,]+)" | fillnull diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index 3e97a3ea43..bf7c9666d5 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2569bb5995..2d13725422 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -49,10 +49,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 374458d818..5de6fed7b9 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description From 2dc3668424cad95cc86da387a44e466ff181c190 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 13:21:31 +0200 Subject: [PATCH 22/52] Extra Logic Fixes From Codex (#4319) --- ...ows_ad_spn_unicode_collision_injection.yml | 2 +- ...named_command_interpreter_was_executed.yml | 6 ---- ...ows_renamed_lolbas_binary_was_executed.yml | 7 +--- ...opular_3rd_party_software_was_executed.yml | 6 ---- ...ows_renamed_python_binary_was_executed.yml | 34 +++++++++++++------ 5 files changed, 25 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml index bc34b8c481..95de6c73ae 100644 --- a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: TTP description: |- - The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index bf7c9666d5..1a57af5204 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_windows_command_interpreter_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_windows_command_interpreter_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2d13725422..2a8a53caf7 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -20,17 +20,12 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_lolbas_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_lolbas_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 5de6fed7b9..640c8aa4ae 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_popular_3rd_party_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_popular_3rd_party_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml index 4f0731c451..e1b2655e8e 100644 --- a/detections/endpoint/windows_renamed_python_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -14,24 +14,36 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime - FROM datamodel=Endpoint.Processes - WHERE - Processes.original_file_name IN ( + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.original_file_name IN ( "py*", "python*", "ipyw*" - ) - NOT Processes.original_file_name IN ("-","unknown") - NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id - Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + ) + + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_renamed_python_binary_was_executed_filter` From c324183503fe293aee96b0e3bd96a4230a92795a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 20:58:11 -0500 Subject: [PATCH 23/52] Decrement version on detection that should not have been bumped because no stanza fields were changed, this detection should not have been bumped. --- ...vm___browser_spawned_unix_shell_with_external_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 15f820549c..72bbe5d099 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 2 +version: 1 creation_date: '2026-09-02' modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk From d339507b4cf7dbd290df265549c9c835f2124ec2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:33:32 -0500 Subject: [PATCH 24/52] another detection that was bumped accidentally --- .../endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4291c2f1be..62be4e512f 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 52449e2a8a9f3743e82ea02c3860d962d02010a5 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Tue, 6 Oct 2026 21:54:32 -0500 Subject: [PATCH 25/52] Push changed to a bunch of files that should not have been bumped --- ...m___mshtml_or_mshta_network_execution_without_url_in_cli.yml | 2 +- ...cisco_nvm___non_network_binary_making_network_connection.yml | 2 +- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../cisco_nvm___rclone_execution_with_network_activity.yml | 2 +- ..._nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml | 2 +- ...m___susp_script_from_archive_triggering_network_activity.yml | 2 +- ...isco_nvm___suspicious_download_from_file_sharing_website.yml | 2 +- ...isco_nvm___suspicious_file_download_via_headless_browser.yml | 2 +- ..._suspicious_network_connection_from_process_with_no_args.yml | 2 +- ..._nvm___suspicious_network_connection_initiated_via_msxsl.yml | 2 +- ...__suspicious_network_connection_to_ip_lookup_service_api.yml | 2 +- ...cisco_nvm___webserver_download_from_file_sharing_website.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index e2b0c93aa3..ff2f2a1108 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,6 +1,6 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index dc296fbfa2..5d9707b471 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 1d63ae1c37..f9a7a87931 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 2 +version: 1 creation_date: '2026-09-18' modification_date: '2026-09-22' author: Radka Viskova, Splunk diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 002d7f3c79..f08391700b 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index c8caad0967..b64b3f4cbe 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index d98e0f72d8..fe101b8b27 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 2d0f030e05..790d763268 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 9e5dd3c33f..868531d281 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index f2e4760a56..c3ab060c00 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index e4cc59a7ea..7a99176ded 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index c7c2ad43c3..6586f1d026 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index f1360e9e90..e79046f8d0 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 5298bf68951862aac12f5a07770c63f8f2ecd4d5 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 7 Oct 2026 19:56:44 +0200 Subject: [PATCH 26/52] Bump contentctl.yml and build.yml to 6.9.0 (#4326) --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index 5a6a252bb0..90e9100bc5 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.8.0 +app_version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index e6c1aceb7c..2669049f6c 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.8.0 + version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 670987f506c251a267de6f4127fe8044359ebc18 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 7 Oct 2026 15:07:34 -0400 Subject: [PATCH 27/52] M365 Copilot detection test description update and promote to production (#4325) --- .../application/m365_copilot_agentic_jailbreak_attack.yml | 6 +++--- .../m365_copilot_impersonation_jailbreak_attack.yml | 6 +++--- ...m365_copilot_information_extraction_jailbreak_attack.yml | 6 +++--- detections/application/m365_copilot_jailbreak_attempts.yml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index e73d2df500..ba76b389cf 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -62,4 +62,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index cba621255a..4659c8a4b8 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-06-04' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -54,4 +54,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 9edff8c36c..b856ed8822 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -93,4 +93,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 28c8410f74..ca4445a565 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -67,4 +67,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. From 87428989de7b9f645bbae05783c6fb05500d9c3e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:13:04 +0200 Subject: [PATCH 28/52] Automated NIST AI RMF detection map update 35 (#4327) --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- .github/workflows/update_nist_ai_rmf_detection_map.yml | 2 +- lookups/csv/detection_subcategory_map.csv | 8 ++++---- lookups/csv/detection_subcategory_map.yml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml index 7d832fed6e..1d362f4878 100644 --- a/.github/workflows/update_nist_ai_rmf_detection_map.yml +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -43,7 +43,7 @@ jobs: commit-message: Update NIST AI RMF detection map branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} base: develop - title: Automated NIST AI RMF detection map update ${{ github.run_number }} + title: Automated NIST AI RMF lookup table update body: | This PR updates the generated NIST AI RMF detection-to-subcategory lookup. diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 391d63fab3..5a4b938343 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -14,10 +14,10 @@ M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anoma M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index b98d706b65..01c7b156b9 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -1,8 +1,8 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 -version: 2 +version: 3 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv -description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. Regenerate with scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py when AI data sources or detections change. +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From 2e47a6e36398c4c9e5f6b5d936cf89602cbd9bd1 Mon Sep 17 00:00:00 2001 From: p4t12ick Date: Thu, 8 Oct 2026 15:08:28 +0200 Subject: [PATCH 29/52] Bug Fix for Issue #4293 (#4324) --------- Co-authored-by: Nasreddine Bencherchali --- ...etect_new_open_s3_buckets_over_aws_cli.yml | 95 +++++++++++++++---- 1 file changed, 77 insertions(+), 18 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 55cad13073..6f54d9dce3 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -1,29 +1,85 @@ name: Detect New Open S3 Buckets over AWS CLI id: 39c61d09-8b30-4154-922b-2d0a694ecc22 -version: 10 +version: 11 creation_date: '2021-01-12' modification_date: '2026-05-13' -author: Patrick Bareiss, Splunk +author: Patrick Bareiss, Splunk, vshcherbakov status: production type: TTP -description: The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. +description: |- + The following analytic detects the creation of open/public S3 buckets via the AWS CLI. + It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. + If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. data_source: - AWS CloudTrail search: |- - `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") - | rename requestParameters.bucketName AS bucketName - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY userIdentity.userName userIdentity.principalId userAgent - bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp - requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control - | rename userIdentity.userName as user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_new_open_s3_buckets_over_aws_cli_filter` -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -references: [] + `cloudtrail` + eventSource="s3.amazonaws.com" + eventName="PutBucketAcl" + errorCode=success + userAgent IN ("[aws-cli*", "aws-cli*") + + | rename requestParameters.bucketName AS bucketName + requestParameters.accessControlList.x-amz-grant-read AS grantRead + requestParameters.accessControlList.x-amz-grant-read-acp AS grantReadAcp + requestParameters.accessControlList.x-amz-grant-write AS grantWrite + requestParameters.accessControlList.x-amz-grant-write-acp AS grantWriteAcp + requestParameters.accessControlList.x-amz-grant-full-control AS grantFullControl + requestParameters.x-amz-acl AS cannedAcl, + userIdentity.principalId AS principalId + userIdentity.userName AS userName + userIdentity.arn AS userArn + + | eval grantRead=coalesce(grantRead,"-"), + grantReadAcp=coalesce(grantReadAcp,"-"), + grantWrite=coalesce(grantWrite,"-"), + grantWriteAcp=coalesce(grantWriteAcp,"-"), + grantFullControl=coalesce(grantFullControl,"-"), + cannedAcl=coalesce(cannedAcl,"-"), + user=coalesce(userName,userArn) + + | eval publicGrant = if( + match(grantRead, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantReadAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWrite, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWriteAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantFullControl, "(?i)AllUsers|AuthenticatedUsers"), + 1, + 0 + ) + + | eval publicCanned = if(cannedAcl IN ("public-read", "public-read-write", "authenticated-read"), 1, 0) + + | where publicGrant=1 OR publicCanned=1 + + | eval exposure=case(cannedAcl=="public-read-write","public-write", match(grantWrite."".grantWriteAcp."".grantFullControl,"(?i)AllUsers"),"public-write", cannedAcl=="public-read" OR match(grantRead,"(?i)AllUsers"),"public-read", cannedAcl=="authenticated-read" OR match(grantRead,"(?i)AuthenticatedUsers"),"authenticated-read", true(),"custom-grant") + + | stats count + min(_time) AS firstTime + max(_time) AS lastTime + values(cannedAcl) AS cannedAcl + values(grantRead) AS grantRead + values(grantReadAcp) AS grantReadAcp + values(grantWrite) AS grantWrite + values(grantWriteAcp) AS grantWriteAcp + values(grantFullControl) AS grantFullControl + values(eventName) AS eventName + + BY user principalId userAgent bucketName exposure + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_new_open_s3_buckets_over_aws_cli_filter` +how_to_implement: |- + The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: |- + It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed. +references: + - https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -34,11 +90,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ + title: User [$user$] has created an open/public S3 Bucket [$bucketName$] using AWS CLI with the following permissions - [$grantRead$] [$grantReadAcp$] [$grantWrite$] [$grantWriteAcp$] [$grantFullControl$] [$cannedAcl$] entity: field: user type: user score: 50 +threat_objects: + - field: bucketName + type: bucket_name analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket From dd8c9a3cb77fbe2179e6bcac08e1303dc61733ec Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 11:40:48 +0200 Subject: [PATCH 30/52] Remove `CrowdStrike ProcessRollup2` Reference from Content Using `parent_process` (#4316) --- detections/endpoint/jscript_execution_using_cscript_app.yml | 5 ++--- detections/endpoint/ping_sleep_batch_command.yml | 5 ++--- .../endpoint/possible_lateral_movement_powershell_spawn.yml | 5 ++--- .../endpoint/svchost_lolbas_execution_process_spawn.yml | 5 ++--- .../endpoint/vbscript_execution_using_wscript_app.yml | 5 ++--- .../windows_command_shell_dcrat_forkbomb_payload.yml | 5 ++--- ...ws_for_loop_usage_within_cmd_exe_to_execute_commands.yml | 5 ++--- .../windows_indirect_command_execution_via_forfiles.yml | 5 ++--- .../windows_indirect_command_execution_via_pcalua.yml | 5 ++--- ...indows_proxy_execution_of__net_utilities_via_scripts.yml | 6 ++---- .../windows_scheduled_task_service_spawned_shell.yml | 5 ++--- detections/endpoint/windows_ssh_proxy_command.yml | 5 ++--- .../windows_suspicious_react_or_next_js_child_process.yml | 5 ++--- detections/endpoint/windows_time_based_evasion.yml | 5 ++--- 14 files changed, 28 insertions(+), 43 deletions(-) diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 4082fc5412..198f9016e6 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,8 +1,8 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 14 +version: 15 creation_date: '2021-09-14' -modification_date: '2026-08-31' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index b34b2835a4..2283e1a9af 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,8 +1,8 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 17 +version: 18 creation_date: '2022-01-20' -modification_date: '2026-08-11' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,7 +14,6 @@ description: |- Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 8fe0edf7a6..6b73129ed4 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,8 +1,8 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 17 +version: 18 creation_date: '2021-11-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: | If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 2d1937a88b..d0ab2e9869 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,8 +1,8 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 15 +version: 16 creation_date: '2021-11-23' -modification_date: '2026-07-27' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -11,7 +11,6 @@ description: |- If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 7ae808c2c9..628db71437 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,15 +1,14 @@ name: Vbscript Execution Using Wscript App id: 35159940-228f-11ec-8a49-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ( diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 8ad38fc09d..f9e7d6f0af 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -1,15 +1,14 @@ name: Windows Command Shell DCRat ForkBomb Payload id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1 -version: 14 +version: 15 creation_date: '2022-07-28' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml index a4e9eadf4a..f3dc13d6c8 100644 --- a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -1,8 +1,8 @@ name: Windows For Loop Usage Within Cmd.exe To Execute Commands id: a4ce9079-fc8f-4749-982a-13197c8cf977 -version: 1 +version: 2 creation_date: '2026-09-16' -modification_date: '2026-09-16' +modification_date: '2026-10-09' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -11,7 +11,6 @@ description: |- Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 2a70eea3f6..de6a411fc9 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via forfiles id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*forfiles* /c *" diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index f5060aafe3..296099e1af 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via pcalua id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*pcalua* -a*" diff --git a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml index 96aadbd743..c8fcafe4e2 100644 --- a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml +++ b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml @@ -1,8 +1,8 @@ name: Windows Proxy Execution of .NET Utilities via Scripts id: eb59cf01-1874-4d16-b7e4-54a6eb9b3118 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -11,8 +11,6 @@ description: |- That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 3694b15b21..2da9f7d103 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task Service Spawned Shell id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 -version: 12 +version: 13 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Steven Dick status: production type: TTP @@ -13,7 +13,6 @@ description: | If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml index d8d2fc28bf..02812d7a62 100644 --- a/detections/endpoint/windows_ssh_proxy_command.yml +++ b/detections/endpoint/windows_ssh_proxy_command.yml @@ -1,8 +1,8 @@ name: Windows SSH Proxy Command id: ac520039-21f1-4567-b528-5b7133dba76f -version: 6 +version: 7 creation_date: '2025-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor status: production type: Anomaly @@ -12,7 +12,6 @@ description: | This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml index 7719a175db..667888e72b 100644 --- a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml +++ b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml @@ -1,8 +1,8 @@ name: Windows Suspicious React or Next.js Child Process id: baa80bc8-7c9c-4395-b458-b69feb92830a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: | Such activity might be a strong indicator of exploitation of the aforementioned vulnerability. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 8356037e58..f8cfd97a98 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -1,8 +1,8 @@ name: Windows Time Based Evasion id: 34502357-deb1-499a-8261-ffe144abf561 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime From d84e86d7e2796c5f06c1373c6e9e532d1620dd78 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 13:16:10 +0200 Subject: [PATCH 31/52] Fix #4275 (#4330) --- detections/endpoint/windows_ngrok_reverse_proxy_usage.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 02f70368d5..0f8ad3b931 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,8 +1,8 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 13 +version: 14 creation_date: '2022-11-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,7 @@ data_source: - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*") + WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*tcp*") BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path From 1b2142fdd2d1358b4ac6ad3dfc47e5e455e619e8 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 17:45:29 +0200 Subject: [PATCH 32/52] Fix Data Sources with Links to Archived TAs (#4307) --- contentctl.yml | 8 ++++---- data_sources/cisco_ios_logs.yml | 12 ++++++------ .../circle_ci_disable_security_job.yml | 10 +++++++--- .../circle_ci_disable_security_step.yml | 10 +++++++--- macros/{ => deprecated}/circleci.yml | 0 scripts/check_archived_tas.py | 2 ++ 6 files changed, 26 insertions(+), 16 deletions(-) rename detections/{cloud => deprecated}/circle_ci_disable_security_job.yml (92%) rename detections/{cloud => deprecated}/circle_ci_disable_security_step.yml (91%) rename macros/{ => deprecated}/circleci.yml (100%) diff --git a/contentctl.yml b/contentctl.yml index 2669049f6c..1d6537fc16 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -241,10 +241,10 @@ apps: version: 4.0.3 hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-indexes_403.tgz - uid: 1467 - title: Cisco Networks Add-on - appid: TA-cisco_ios - version: 2.7.9 - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz + title: Cisco Enterprise Networking Add-on for Splunk + appid: TA-cisco-enterprise-networking-add-on-for-splunk + version: 4.0.35 + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-enterprise-networking-add-on-for-splunk_4035.tgz - uid: 8024 title: TA-ollama appid: ta-ollama diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index bf6b6c5e82..d8d10d3b7e 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -1,17 +1,17 @@ name: Cisco IOS Logs id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f -version: 2 +version: 3 creation_date: '2025-08-21' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Michael Haag, Splunk -description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG. +description: Data source object for Cisco IOS system logs. source: cisco:ios sourcetype: cisco:ios separator: supported_TA: - - name: Cisco Networks Add-on - url: https://splunkbase.splunk.com/app/1467 - version: 2.8.2 + - name: Cisco Enterprise Networking Add-on for Splunk + url: https://splunkbase.splunk.com/app/7538 + version: 4.0.35 fields: - _time - aci_message_text diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/deprecated/circle_ci_disable_security_job.yml similarity index 92% rename from detections/cloud/circle_ci_disable_security_job.yml rename to detections/deprecated/circle_ci_disable_security_job.yml index 22d5f05039..b93cd1860a 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/deprecated/circle_ci_disable_security_job.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 11 +version: 12 creation_date: '2021-09-02' -modification_date: '2026-09-22' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity. data_source: @@ -60,3 +60,7 @@ tests: sourcetype: circleci source: circleci test_type: unit +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/deprecated/circle_ci_disable_security_step.yml similarity index 91% rename from detections/cloud/circle_ci_disable_security_step.yml rename to detections/deprecated/circle_ci_disable_security_step.yml index 9f5d5ce02e..5b234e57c1 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/deprecated/circle_ci_disable_security_step.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Step id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -version: 9 +version: 10 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes. data_source: @@ -58,3 +58,7 @@ tests: source: circleci test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/macros/circleci.yml b/macros/deprecated/circleci.yml similarity index 100% rename from macros/circleci.yml rename to macros/deprecated/circleci.yml diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index a3b433e070..27269974dd 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -61,6 +61,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: detection = load_yaml(path) if not detection: continue + if str(detection.get("status") or "").strip().casefold() == "deprecated": + continue references = detection.get("data_source") or [] if isinstance(references, str): references = [references] From e2275d40f9c12302e04479c845d30efcffbe3cb9 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 12 Oct 2026 03:45:51 -0500 Subject: [PATCH 33/52] Update data source TA and install.yml app versions (#4335) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/cisco_ios_logs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index d8d10d3b7e..31ab89661c 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Enterprise Networking Add-on for Splunk url: https://splunkbase.splunk.com/app/7538 - version: 4.0.35 + version: 4.0.50 fields: - _time - aci_message_text From c653da7c11fc74a5410646c96cb05b8998fd6d44 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 12 Oct 2026 15:04:44 +0200 Subject: [PATCH 34/52] Add Atomic GUID Mappings - Batch 1 (#4315) --- .../detect_html_help_spawn_child_process.yml | 5 +++- .../access_lsass_memory_for_dump_creation.yml | 5 +++- .../adsisearcher_account_discovery.yml | 5 +++- .../bcdedit_failure_recovery_modification.yml | 5 +++- detections/endpoint/bits_job_persistence.yml | 5 +++- .../endpoint/bitsadmin_download_file.yml | 5 +++- .../certutil_with_decode_argument.yml | 5 +++- ...t___curl_execution_with_insecure_flags.yml | 3 ++- ..._loading_from_world_writable_directory.yml | 5 +++- ...or_delete_windows_shares_using_net_exe.yml | 7 +++++- .../creation_of_lsass_dump_with_taskmgr.yml | 5 +++- .../endpoint/creation_of_shadow_copy.yml | 7 +++++- ...f_shadow_copy_with_wmic_and_powershell.yml | 7 +++++- ...ping_via_copy_command_from_shadow_copy.yml | 5 +++- ...ial_dumping_via_symlink_to_shadow_copy.yml | 5 +++- .../delete_shadowcopy_with_powershell.yml | 5 +++- .../endpoint/deleting_shadow_copies.yml | 5 +++- ...redential_dumping_through_lsass_access.yml | 5 +++- .../detect_html_help_url_in_command_line.yml | 5 +++- ...l_help_using_infotech_storage_handlers.yml | 5 +++- .../detect_mshta_inline_hta_execution.yml | 9 ++++++- .../detect_mshta_url_in_command_line.yml | 5 +++- .../detect_new_local_admin_account.yml | 7 ++++-- ...nterception_by_creation_of_program_exe.yml | 5 +++- .../detect_psexec_with_accepteula_flag.yml | 5 +++- ...ct_regsvr32_application_control_bypass.yml | 5 +++- ...t_remote_access_software_usage_process.yml | 25 ++++++++++++++++++- .../detect_rundll32_inline_hta_execution.yml | 7 +++++- ...tect_sharphound_command_line_arguments.yml | 5 +++- .../detect_sharphound_file_modifications.yml | 5 +++- .../endpoint/detect_sharphound_usage.yml | 5 +++- .../endpoint/disable_etw_through_registry.yml | 7 +++++- .../endpoint/disable_logs_using_wevtutil.yml | 5 +++- detections/endpoint/disable_registry_tool.yml | 5 +++- .../disable_windows_behavior_monitoring.yml | 5 +++- .../endpoint/disabling_cmd_application.yml | 5 +++- .../disabling_remote_user_account_control.yml | 7 ++++-- .../disabling_systemrestore_in_registry.yml | 5 +++- ...main_group_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/dsquery_domain_discovery.yml | 5 +++- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 5 +++- .../endpoint/dump_lsass_via_procdump.yml | 5 +++- ...le_wdigest_uselogoncredential_registry.yml | 7 +++++- detections/endpoint/esentutl_sam_copy.yml | 5 +++- detections/endpoint/eventvwr_uac_bypass.yml | 7 +++++- detections/endpoint/fodhelper_uac_bypass.yml | 7 +++++- ...ltdomainpasswordpolicy_with_powershell.yml | 5 +++- .../endpoint/get_aduser_with_powershell.yml | 5 +++- ...et_aduser_with_powershell_script_block.yml | 5 +++- .../get_domainpolicy_with_powershell.yml | 5 +++- .../get_domaintrust_with_powershell.yml | 5 +++- .../get_domainuser_with_powershell.yml | 5 +++- .../get_foresttrust_with_powershell.yml | 5 +++- .../get_wmiobject_group_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...dcomputer_with_powershell_script_block.yml | 5 +++- .../endpoint/getadgroup_with_powershell.yml | 5 +++- ...etadgroup_with_powershell_script_block.yml | 5 +++- .../getcurrent_user_with_powershell.yml | 5 +++- ...rent_user_with_powershell_script_block.yml | 5 +++- .../getdomaincontroller_with_powershell.yml | 5 +++- .../getdomaingroup_with_powershell.yml | 5 +++- ...maingroup_with_powershell_script_block.yml | 5 +++- .../endpoint/getlocaluser_with_powershell.yml | 5 +++- ...twmiobject_ds_computer_with_powershell.yml | 5 +++- ..._files_and_directories_with_attrib_exe.yml | 7 ++++-- ...ovement_wmiexec_commandline_parameters.yml | 5 +++- ...asting_spn_request_with_rc4_encryption.yml | 7 +++++- .../endpoint/linux_add_user_account.yml | 5 +++- .../linux_at_application_execution.yml | 5 ++-- .../linux_auditd_add_user_account.yml | 5 +++- .../linux_auditd_clipboard_data_copy.yml | 5 +++- .../linux_auditd_dd_file_overwrite.yml | 5 +++- ...ux_auditd_file_and_directory_discovery.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- ...td_possible_access_to_credential_files.yml | 5 +++- .../endpoint/linux_auditd_stop_services.yml | 5 +++- ...system_network_configuration_discovery.yml | 5 +++- .../linux_auditd_whoami_user_discovery.yml | 5 +++- .../endpoint/linux_clipboard_data_copy.yml | 5 +++- .../endpoint/linux_curl_upload_file.yml | 5 +++- .../endpoint/linux_dd_file_overwrite.yml | 5 +++- .../endpoint/linux_decode_base64_to_shell.yml | 5 +++- .../linux_docker_root_directory_mount.yml | 5 +++- .../linux_ingress_tool_transfer_hunting.yml | 5 +++- .../linux_ingress_tool_transfer_with_curl.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- .../linux_kernel_module_enumeration.yml | 5 +++- .../endpoint/linux_magic_sysrq_key_abuse.yml | 7 +++++- ...ted_files_or_information_base64_decode.yml | 5 +++- ...linux_ssh_authorized_keys_modification.yml | 5 +++- .../linux_system_network_discovery.yml | 5 +++- ...x_system_reboot_via_system_request_key.yml | 5 +++- .../endpoint/macos_gatekeeper_bypass.yml | 5 +++- .../endpoint/macos_keychains_dumped.yml | 5 +++- .../endpoint/macos_list_firewall_rules.yml | 5 +++- .../macos_network_share_discovery.yml | 5 +++- ...ript_displaying_suspicious_user_prompt.yml | 7 +++++- ...s_powershell_process___encoded_command.yml | 5 +++- ...nitor_registry_keys_for_print_monitors.yml | 7 ++++-- ...etwork_share_discovery_via_dir_command.yml | 3 ++- .../nltest_domain_trust_discovery.yml | 5 +++- detections/endpoint/ntdsutil_export_ntds.yml | 5 +++- .../overwriting_accessibility_binaries.yml | 17 +++++++++++-- ..._hijacking_inprocserver32_modification.yml | 5 +++- ...powershell_disable_security_monitoring.yml | 5 +++- .../powershell_enable_powershell_remoting.yml | 5 +++- .../powershell_execute_com_object.yml | 5 +++- .../powershell_get_localgroup_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...powershell_invoke_cimmethod_cimsession.yml | 5 +++- .../powershell_start_bitstransfer.yml | 5 +++- .../powershell_start_or_stop_service.yml | 5 +++- .../endpoint/process_execution_via_wmi.yml | 7 ++++-- ...istry_keys_for_creating_shim_databases.yml | 7 ++++-- .../registry_keys_used_for_persistence.yml | 7 ++++-- ...try_keys_used_for_privilege_escalation.yml | 9 ++++++- ...2_silent_and_install_param_dll_loading.yml | 5 +++- .../remote_process_instantiation_via_wmi.yml | 5 +++- ...ote_system_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/remote_wmi_command_attempt.yml | 5 +++- .../endpoint/resize_shadowstorage_volume.yml | 5 +++- .../endpoint/rundll32_control_rundll_hunt.yml | 5 +++- .../rundll_loading_dll_by_ordinal.yml | 5 +++- ...eduled_task_deleted_or_created_via_cmd.yml | 5 +++- ...led_task_initiation_on_remote_endpoint.yml | 5 +++- ...htasks_scheduling_job_on_remote_system.yml | 7 ++++-- ...ceprincipalnames_discovery_with_setspn.yml | 5 +++- .../endpoint/shim_database_file_creation.yml | 7 ++++-- ...nstallation_with_suspicious_parameters.yml | 7 ++++-- .../endpoint/short_lived_windows_accounts.yml | 7 +++++- ...ation_certificates_behavior_identified.yml | 5 +++- ...ious_microsoft_workflow_compiler_usage.yml | 5 +++- .../suspicious_mshta_child_process.yml | 7 +++++- .../endpoint/suspicious_reg_exe_process.yml | 5 +++- .../endpoint/suspicious_rundll32_startw.yml | 5 +++- .../endpoint/suspicious_wevtutil_usage.yml | 5 +++- ...system_information_discovery_detection.yml | 9 ++++++- ...rocesses_run_from_unexpected_locations.yml | 5 +++- .../system_user_discovery_with_query.yml | 7 +++++- .../endpoint/unload_sysmon_filter_driver.yml | 5 +++- ...ser_discovery_with_env_vars_powershell.yml | 5 +++- ..._with_env_vars_powershell_script_block.yml | 5 +++- detections/endpoint/usn_journal_deletion.yml | 5 +++- .../wbadmin_delete_system_backups.yml | 5 +++- ...ss_token_manipulation_sedebugprivilege.yml | 5 +++- .../windows_ad_dsrm_password_reset.yml | 5 +++- detections/endpoint/windows_adfind_exe.yml | 8 +++++- ...itelisting_bypass_attempt_via_rundll32.yml | 11 +++++++- ...ndows_attempt_to_stop_security_service.yml | 5 +++- ...ion_lsass_driver_registry_modification.yml | 5 +++- ...roxy_execution_mavinject_dll_injection.yml | 5 +++- ...ows_cabinet_file_extraction_via_expand.yml | 5 +++- ...ckdoor_execution_via_powershell_script.yml | 5 +++- .../endpoint/windows_create_local_account.yml | 7 +++++- ...te_local_administrator_account_via_net.yml | 7 ++++-- ...ential_dumping_lsass_memory_createdump.yml | 5 +++- ...ndows_curl_download_to_suspicious_path.yml | 5 +++- ...dows_curl_upload_to_remote_destination.yml | 5 +++- ...sable_change_password_through_registry.yml | 5 +++- ...k_workstation_feature_through_registry.yml | 5 +++- ...disable_logoff_button_through_registry.yml | 5 +++- .../windows_disable_notification_center.yml | 5 +++- ...sable_shutdown_button_through_registry.yml | 5 +++- ...ows_event_logging_disable_http_logging.yml | 5 +++- ...group_policy_features_through_registry.yml | 17 ++++++++++++- .../windows_disableantispyware_registry.yml | 7 +++++- .../endpoint/windows_dism_remove_defender.yml | 5 +++- ...earch_order_hijacking_hunt_with_sysmon.yml | 5 +++- ...ows_dotnet_binary_in_non_standard_path.yml | 5 +++- ...ws_entra_user_management_via_azure_cli.yml | 5 +++- ...dows_esx_admins_group_creation_via_net.yml | 5 +++- .../endpoint/windows_event_log_cleared.yml | 5 +++- ...ows_event_logging_service_has_shutdown.yml | 7 +++++- ...image_file_execution_options_injection.yml | 5 +++- .../windows_eventlog_cleared_via_wevtutil.yml | 5 +++- .../endpoint/windows_export_certificate.yml | 5 +++- .../windows_file_download_via_certutil.yml | 7 +++++- .../windows_file_download_via_powershell.yml | 5 +++- ...ws_file_share_discovery_with_powerview.yml | 5 +++- ..._access_rights_modification_via_icacls.yml | 5 ++-- ..._exe_execution_from_windowsapps_folder.yml | 5 +++- .../windows_group_discovery_via_net.yml | 5 +++- ...dows_guest_account_enabled_via_net_exe.yml | 6 ++++- ...ttp_network_communication_from_msiexec.yml | 5 +++- .../windows_identify_protocol_handlers.yml | 5 +++- .../windows_iis_components_add_new_module.yml | 5 +++- ...indows_iis_components_new_module_added.yml | 5 +++- ...r_defenses_disable_auto_logger_session.yml | 5 +++- .../windows_impair_defenses_disable_hvci.yml | 3 ++- ...ndirect_command_execution_via_forfiles.yml | 3 +++ ..._indirect_command_execution_via_pcalua.yml | 3 +++ ...mmand_execution_via_series_of_forfiles.yml | 5 +++- ..._input_capture_using_credential_ui_dll.yml | 5 +++- ...ndows_installutil_in_non_standard_path.yml | 5 +++- .../windows_installutil_uninstall_option.yml | 5 +++- ...ndows_ldifde_directory_object_behavior.yml | 3 ++- ...dows_linked_policies_in_adsi_discovery.yml | 5 +++- ...mimikatz_crypto_export_file_extensions.yml | 5 +++- ...y_registry_authenticationleveloverride.yml | 5 +++- ...dows_modify_registry_auto_update_notif.yml | 5 ++-- .../windows_modify_registry_disable_rdp.yml | 5 +++- ...y_registry_disable_toast_notifications.yml | 5 +++- ...y_disable_win_defender_raw_write_notif.yml | 5 +++- ...stry_disable_windefender_notifications.yml | 3 ++- ..._disable_windows_security_center_notif.yml | 5 +++- ...registry_disableremotedesktopantialias.yml | 5 +++- ...odify_registry_disablesecuritysettings.yml | 5 +++- ...modify_registry_disabling_wer_settings.yml | 5 +++- ...s_modify_registry_disallow_windows_app.yml | 5 +++- ..._registry_do_not_connect_to_win_update.yml | 5 ++-- .../windows_modify_registry_dontshowui.yml | 5 +++- ...odify_registry_enablelinkedconnections.yml | 3 ++- ...ndows_modify_registry_longpathsenabled.yml | 3 ++- ...modify_registry_maxconnectionperserver.yml | 5 +++- ...egistry_no_auto_reboot_with_logon_user.yml | 5 ++-- ...windows_modify_registry_no_auto_update.yml | 5 ++-- ...fy_registry_on_smart_card_group_policy.yml | 5 +++- .../windows_modify_registry_proxyenable.yml | 5 +++- .../windows_modify_registry_proxyserver.yml | 5 +++- ...y_registry_suppress_win_defender_notif.yml | 5 +++- ...dows_modify_registry_tamper_protection.yml | 5 ++-- ...w_compress_color_and_info_tip_registry.yml | 5 +++- ..._mof_event_triggered_execution_via_wmi.yml | 5 +++- .../windows_msiexec_dllregisterserver.yml | 5 +++- .../windows_msiexec_remote_download.yml | 5 +++- ...s_msiexec_unregister_dllregisterserver.yml | 5 +++- ...d_to_authenticate_from_host_using_ntlm.yml | 5 +++- .../windows_net_system_service_discovery.yml | 5 +++- ...dows_network_share_interaction_via_net.yml | 7 ++++-- ...windows_network_sniffing_tool_executed.yml | 7 +++++- ...ity_descriptor_set_on_eventlog_channel.yml | 5 +++- ...ntlog_channelaccess_registry_value_set.yml | 5 +++- .../endpoint/windows_nirsoft_advancedrun.yml | 5 +++- .../endpoint/windows_nirsoft_utilities.yml | 5 +++- ...ows_non_system_account_targeting_lsass.yml | 5 +++- .../endpoint/windows_odbcconf_hunting.yml | 7 +++++- .../endpoint/windows_odbcconf_load_dll.yml | 5 +++- .../windows_odbcconf_load_response_file.yml | 5 +++- ..._outlook_webview_registry_modification.yml | 5 +++- ...dows_parent_pid_spoofing_with_explorer.yml | 5 +++- .../windows_possible_credential_dumping.yml | 5 +++- ...indows_powershell_disable_http_logging.yml | 5 +++- .../windows_powershell_export_certificate.yml | 5 +++- ...ndows_powershell_export_pfxcertificate.yml | 5 +++- ...rshell_get_ciminstance_remote_computer.yml | 5 +++- ...l_iis_components_webglobalmodule_usage.yml | 5 +++- .../windows_powershell_scheduletask.yml | 3 ++- ...erview_kerberos_service_ticket_request.yml | 5 +++- .../endpoint/windows_proxy_via_netsh.yml | 3 ++- .../endpoint/windows_proxy_via_registry.yml | 3 ++- ...dows_registry_bootexecute_modification.yml | 5 +++- .../windows_registry_certificate_added.yml | 5 +++- ...y_dotnet_etw_disabled_via_env_variable.yml | 11 +++++++- ...modification_for_safe_mode_persistence.yml | 7 +++++- .../windows_remote_create_service.yml | 5 +++- ..._root_domain_linked_policies_discovery.yml | 5 +++- .../windows_runmru_command_execution.yml | 3 ++- ...curity_descriptor_tampering_via_sc_exe.yml | 5 +++- ...ows_sensitive_group_discovery_with_net.yml | 5 +++- ...ive_registry_hive_dump_via_commandline.yml | 7 +++++- .../windows_service_create_with_tscon.yml | 5 +++- ..._service_creation_using_registry_entry.yml | 5 +++- .../windows_service_execution_remcom.yml | 5 +++- .../endpoint/windows_service_stop_attempt.yml | 5 +++- ...snake_malware_file_modification_crmlog.yml | 3 ++- ...s_snake_malware_kernel_driver_comadmin.yml | 3 ++- ...istry_modification_wav_openwithprogids.yml | 3 ++- .../windows_snake_malware_service_create.yml | 3 ++- .../endpoint/windows_sqlcmd_execution.yml | 5 +++- ..._authentication_certificates_cryptoapi.yml | 5 +++- ...cation_certificates_export_certificate.yml | 5 +++- ...ion_certificates_export_pfxcertificate.yml | 5 +++- .../endpoint/windows_subinacl_execution.yml | 5 +++- ...execution_compiled_html_file_decompile.yml | 5 +++- ...em_network_connections_discovery_netsh.yml | 5 +++- ...oxy_execution_syncappvpublishingserver.yml | 5 +++- ...dows_system_time_discovery_w32tm_delay.yml | 5 +++- ...indows_system_user_discovery_via_quser.yml | 7 +++++- .../windows_wmi_process_call_create.yml | 5 +++- ...windows_wmi_reconnaissance_class_query.yml | 9 ++++++- .../windows_wmic_shadowcopy_delete.yml | 5 +++- .../windows_wmic_systeminfo_discovery.yml | 5 +++- .../wmi_permanent_event_subscription.yml | 9 ++++++- ..._permanent_event_subscription___sysmon.yml | 9 ++++++- detections/endpoint/wmic_group_discovery.yml | 5 +++- .../endpoint/wmic_xsl_execution_via_url.yml | 5 +++- .../xsl_script_execution_with_wmic.yml | 5 +++- 288 files changed, 1254 insertions(+), 306 deletions(-) diff --git a/detections/application/detect_html_help_spawn_child_process.yml b/detections/application/detect_html_help_spawn_child_process.yml index 0b070d3838..27905230b3 100644 --- a/detections/application/detect_html_help_spawn_child_process.yml +++ b/detections/application/detect_html_help_spawn_child_process.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 16 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 5cb87818-0d7c-4469-b7ef-9224107aebe8 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e09ae3823a..bb435a02c5 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -2,7 +2,7 @@ name: Access LSASS Memory for Dump Creation id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 9092c986ea..9e7ebdc39c 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -2,7 +2,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 version: 13 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://www.blackhillsinfosec.com/red-blue-purple/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L234 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -55,6 +56,8 @@ analytic_story: - Data Destruction - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 02e8be5a-3065-4e54-8cc8-a14d138834d3 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 9db0967a1f..c2c09667a3 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -2,7 +2,7 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may modify the boot configuration. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L66 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - cf21060a-80b3-4238-a595-22525de4ab81 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b7f6c0dce0..d60fb19be3 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -2,7 +2,7 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 version: 13 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L51 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - BITS Jobs - Living Off The Land asset_type: Endpoint +atomic_guid: + - 62a06ec5-5754-47d2-bcfc-123d8314c6ae mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index ec76c0eedf..76c73828b1 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -2,7 +2,7 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 version: 18 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Sittikorn S status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L236 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b mitre_attack_id: - T1197 - T1105 diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 42845a1248..69b55219b9 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -2,7 +2,7 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 version: 15 creation_date: '2021-03-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L25 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ threat_group: - Cozy Bear - Midnight Blizzard asset_type: Endpoint +atomic_guid: + - 71abc534-3c05-4d0c-80f7-cbe93cb2aa94 mitre_attack_id: - T1140 product: diff --git a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml index e7875db3e4..eaf17da0a9 100644 --- a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco Isovalent - Curl Execution With Insecure Flags id: c16c4899-d3f7-461b-92c2-cc0ef5758855 version: 5 creation_date: '2026-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ known_false_positives: This activity may be triggered by legitimate administrati references: - https://rawcode7.medium.com/understanding-the-kubernetes-attack-surface-9a48ebcb6bc4 - https://www.tutorialworks.com/kubernetes-curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L1275 drilldown_searches: - name: View the detection results for - "$pod_name$" search: '%original_detection_search% | search pod_name = "$pod_name$"' diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 49b1b9120d..7eb280d820 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -2,7 +2,7 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 version: 13 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://attack.mitre.org/techniques/T1218/011/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.002/T1218.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - 037e9d8a-9e46-4255-8b33-2ae3b545ca6f mitre_attack_id: - T1218.002 product: diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 88e5ff9751..d5039c90a2 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -2,7 +2,7 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -30,6 +30,8 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. references: - https://attack.mitre.org/techniques/T1070/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Prestige Ransomware - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 14c38f32-6509-46d8-ab43-d53e32d2b131 + - 09210ad5-1ef2-4077-9ad3-7351e13e9222 mitre_attack_id: - T1070.005 product: diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 25294be65c..c0b325b230 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -2,7 +2,7 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd version: 15 creation_date: '2019-12-11' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager - https://attack.mitre.org/techniques/T1003/001/ - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L122 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Seashell Blizzard - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - dea6c349-f1c6-44f3-87a1-1ed33a59a607 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 05b52a9935..d5262c808c 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy id: eb120f5f-b879-4a63-97c1-93352b5df844 version: 13 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -33,6 +33,8 @@ known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will c references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f + - 224f7de0-8f0a-4a94-b5d8-989b036c86da mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index f6257bbe42..92750935e2 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Legitimate administrator usage of wmic to create a shadow references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L204 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +61,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 224f7de0-8f0a-4a94-b5d8-989b036c86da + - 542bb97e-da53-436b-8e43-e0a7d31a6c24 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c62a95e452..39fdc97d94 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L31 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - c6237146-9ea6-4711-85c9-c56d263a6b03 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 4363f7400e..2dc83ba016 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L228 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 21748c28-2793-4284-9e07-d6d028b66702 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index c5148d86a4..55a0ec44a1 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -2,7 +2,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 version: 13 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L82 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - Cactus Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - 39a295ca-7059-4a88-86f6-09556c1211e7 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index a631794038..4e8f64722a 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -2,7 +2,7 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. references: - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -80,6 +81,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - 43819286-91a9-4369-90ed-d31fb4da2c01 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 975c102a40..a7052b3dca 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -2,7 +2,7 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 version: 16 creation_date: '2019-12-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -49,6 +49,7 @@ known_false_positives: The activity may be legitimate. Other tools can access ls references: - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ - https://attack.mitre.org/techniques/T1003/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -75,6 +76,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index b12bf89d2b..5cd4424c36 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L30 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Compromised Windows Host - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 0f8af516-9818-4172-922b-42986ef1e81d mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 246aba48a5..874d1399a0 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L121 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 4f83adda-f5ec-406d-b318-9773c9ca92e5 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 444545ff5e..bac8267504 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 version: 22 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,9 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +74,10 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 1483fab9-4f52-4217-a9ce-daa9d7747cae + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index a38dbcb988..e2e3393837 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 version: 21 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing - https://denwp.com/dissecting-lumma-malware/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L32 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - NetSupport RMM Tool Abuse - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - c4b97eeb-5249-4455-a607-59f95485cb45 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 10c569305e..f3230cf3a9 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -2,7 +2,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -36,7 +36,8 @@ search: | | `detect_new_local_admin_account_filter` how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -65,6 +66,8 @@ analytic_story: - CISA AA24-241A - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 3c269270f4..0e9292cc27 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -2,7 +2,7 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.009/T1574.009.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Persistence Techniques - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 2770dea7-c50f-457b-84c4-c40a47460d9f mitre_attack_id: - T1574.009 product: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index cdc2f6698e..847e1b446b 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -2,7 +2,7 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L55 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - VanHelsing Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 0eb03d41-79e4-4393-8e57-6344856be1cf mitre_attack_id: - T1021.002 product: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d6c5a7d777..6c4e565d05 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -2,7 +2,7 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L38 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint +atomic_guid: + - c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36 mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b80e1ec8b9..b579e35a22 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -2,7 +2,7 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -34,6 +34,17 @@ references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L222 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L250 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L287 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L314 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L342 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L371 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L452 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L483 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L509 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -77,6 +88,18 @@ analytic_story: - Scattered Lapsus$ Hunters - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 + - d03683ec-aae0-42f9-9b4c-534780e0f8e1 + - 0ae9e327-3251-465a-a53b-485d4e3f58fa + - fbff3f1f-b0bf-448e-840f-7e1687affdce + - ecca999b-e0c8-40e8-8416-ad320b146a75 + - 19acf63b-55c4-4b6a-8552-00a8865105c8 + - 42e51815-a6cc-4c75-b970-3f0ff54b610e + - b1b8128b-c5d4-4de9-bf70-e60419274562 + - b025c580-029e-4023-888d-a42710d76934 + - 3e1858ee-3550-401c-86ec-5e70ed79295b + - 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 mitre_attack_id: - T1219 product: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 55da551a7b..84014e941a 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect Rundll32 Inline HTA Execution id: 91c79f14-5b41-11eb-ae93-0242ac130002 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,8 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L25 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - Living Off The Land - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 638730e7-7aed-43dc-bf8c-8117f805f5bb + - 32d1cf1b-cbc2-4c09-8d05-07ec5c83a821 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 63bdf21836..29bf819406 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Command-Line Arguments id: a0bdd2f6-c2ff-11eb-b918-acde48001122 version: 12 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 37561415c3..30c27dcd9d 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -2,7 +2,7 @@ name: Detect SharpHound File Modifications id: 42b4b438-beed-11eb-ba1d-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index ae3e4b97b9..db38a68f5d 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Usage id: dd04b29a-beed-11eb-87bc-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - Windows Discovery Techniques - Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 1e8c89f64a..0f2a1fc0a0 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 15 creation_date: '2021-06-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operator may disable this feature of windows but not so common. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1571 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1581 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +36,9 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8a4c33be-a0d3-434a-bee6-315405edbd5b + - 19c07a45-452d-4620-90ed-4c34fffbe758 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 6781010042..88c0511f90 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -2,7 +2,7 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 version: 14 creation_date: '2021-06-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: network operator may disable audit event logs for debugging purposes. references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L105 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - b26a3340-dad7-4360-9176-706269c74103 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 95c6027ece..29007d8b5c 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L174 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8 mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index f01e4f92e9..d08ed0971c 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 24 creation_date: '2021-03-31' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index ca614ff952..947161c2e4 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L188 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - d2561a6d-72bd-408c-b150-13efe1801c2a mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3e4d52301e..3332cbc903 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,7 +2,7 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Patrick Bareiss, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L151 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Azorult - AgentTesla asset_type: Endpoint +atomic_guid: + - 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 1d00844d93..3a75b8fc09 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: in some cases admin can disable systemrestore on a machine. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L132 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - 66e647d1-8741-4e43-b7c1-334760c2047f mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 1a3b7b14d2..4913e9b7ab 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Domain Group Discovery with Adsisearcher id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 version: 14 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L150 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 9f4e344b-8434-41b3-85b1-d38f29d148d0 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 0897dbdc89..12add244b6 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -2,7 +2,7 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 version: 13 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Domain Trust Discovery - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 4700a710-c821-4e17-a3ec-9e4c81d6845f mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index e5bad39bcf..ce62844c17 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -2,7 +2,7 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 version: 17 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Patrick Bareiss, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L45 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - 2536dee2-12fb-459a-8c37-971844fa73be mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c02b721f03..f83b777679 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -2,7 +2,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 version: 20 creation_date: '2021-02-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -76,6 +76,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://x.com/wietze/status/1958302556033065292?s=12 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -110,6 +111,8 @@ analytic_story: - Seashell Blizzard - Storm-2460 CLFS Zero Day Exploitation asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index e207d4573f..e2c065432a 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 16 creation_date: '2021-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L54 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +42,9 @@ analytic_story: - Windows Registry Abuse - CISA AA22-320A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 + - 68254a85-aa42-4312-a695-38b7276307f8 mitre_attack_id: - T1112 - T1003 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index bff789bd1f..508a661ec4 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -2,7 +2,7 @@ name: Esentutl SAM Copy id: d372f928-ce4f-11eb-a762-acde48001122 version: 10 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ known_false_positives: False positives should be limited. Filter as needed. references: - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md - https://attack.mitre.org/software/S0404/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L66 analytic_story: - Credential Dumping - Living Off The Land asset_type: Endpoint +atomic_guid: + - a90c2f4d-6726-444e-99d2-a00cd7c20480 mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 9238e5d7ff..277d02f452 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -2,7 +2,7 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 version: 13 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://attack.mitre.org/techniques/T1548/002/ - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L24 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Windows Registry Abuse - ValleyRAT asset_type: Endpoint +atomic_guid: + - 5073adf8-9a50-4bd9-b298-a9bd2ead8af9 + - a6ce9acf-842a-4af6-8f79-539be7608e2b mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 6faaff19d7..f42622c18f 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -2,7 +2,7 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 version: 15 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 - https://attack.mitre.org/techniques/T1548/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L64 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Windows Defense Evasion Tactics - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 58f641ea-12e3-499a-b684-44dee46bd182 + - 3f627297-6c38-4e7d-a278-fc2563eaaeaa mitre_attack_id: - T1112 - T1548.002 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 35e8d5cd71..94aabd68e7 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell id: 36e46ebe-065a-11ec-b4c7-acde48001122 version: 10 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -49,9 +49,12 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://attack.mitre.org/techniques/T1201/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L110 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b2698b33-984c-4a1c-93bb-e4ba72a0babb mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index bb2744dac8..0fd84d5b52 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -36,10 +36,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index b6c105338e..7d47e8dcce 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -27,10 +27,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 19669f89fd..6a4263494e 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 version: 11 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ - https://attack.mitre.org/techniques/T1201/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L99 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3177f4da-3d4b-4592-8bdc-aa23d0b2e843 mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 8276c690bd..f74ffdc7a4 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-DomainTrust with PowerShell id: 4fa7f846-054a-11ec-a836-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L118 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - f974894c-5991-4b19-aaf5-7cc2fe298c5d mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a8879480e6..88ec1582df 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 12 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L223 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 93662494-5ed7-4454-a04c-8c8372808ac2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 41c578874e..e64ae44fd8 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-ForestTrust with PowerShell id: 584f4884-0bf1-11ec-a5ec-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L130 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 58ed10e8-0738-4651-8408-3a3e9a526279 mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index dcba3dc093..4598e7afaa 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery id: 5434f670-155d-11ec-8cca-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 3a2cdee9a5..06687a5f05 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery with Script Block Logging id: 69df7f7c-155d-11ec-a055-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 600cf3dc6d..4c45f3b055 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,12 +25,15 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1018/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L346 analytic_story: - Active Directory Discovery - CISA AA22-320A - Medusa Ransomware - Gozi Malware asset_type: Endpoint +atomic_guid: + - 97e89d9e-e3f5-41b5-a90f-1e0825df0fdf mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 997e7928c3..c1bbefd3b0 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 42f816782f..6e962e2892 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell Script Block id: e4c73d68-794b-468d-b4d0-dac1772bbae7 version: 12 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,10 +26,13 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 543c998725..4920d258f4 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L67 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 1392bd0f-5d5a-429e-81d9-eb9d4d4d5b3b mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index bda0937e98..a1f4716abc 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell Script Block id: 80879283-c30f-44f7-8471-d1381f6d437a version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,9 +26,12 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1033/ - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-6.0&viewFallbackFrom=net-5.0 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 6d257dfc2b..47c45c98fc 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainController with PowerShell id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 version: 8 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use PowerView for troub references: - https://attack.mitre.org/techniques/T1018/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L372 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b9d2e8ca-5520-4737-8076-4f08913da2c4 mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 538ed03bad..4a0f23382c 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell id: 93c94be3-bead-4a60-860f-77ca3fe59903 version: 11 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,6 +33,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L200 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -51,6 +52,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 5a8a181c-2c8e-478d-a943-549305a01230 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 0e920c4bf7..a02305e903 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 version: 13 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this PowerView func references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L138 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -44,6 +45,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3d1fcd2a-e51c-4cbe-8d84-9a843bad8dc8 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 4401f35638..e5b1606c69 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -2,7 +2,7 @@ name: GetLocalUser with PowerShell id: 85fae8fa-0427-11ec-8b78-acde48001122 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.001/T1087.001.yaml#L151 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b mitre_attack_id: - T1087.001 product: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 484c938c43..fa061c119e 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -2,7 +2,7 @@ name: GetWmiObject Ds Computer with PowerShell id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 version: 9 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ known_false_positives: |- Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L383 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -77,6 +78,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - e3cf5123-f6c9-4375-bdf2-1bb3ba43a1ad mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 13d308b078..b23955db43 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -2,7 +2,7 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -27,7 +27,8 @@ search: |- | `hiding_files_and_directories_with_attrib_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L90 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Crypto Stealer - VIP Keylogger asset_type: Endpoint +atomic_guid: + - 32b979da-7b68-42c9-9a99-0e39900fc36c mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index a2989a0e6a..c0a9f61513 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -2,7 +2,7 @@ name: Impacket Lateral Movement WMIExec Commandline Parameters id: d6e464e4-5c6a-474e-82d2-aed616a3a492 version: 12 creation_date: '2021-11-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -24,6 +24,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L238 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA22-277A - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - a3ddaf15-d1a1-4bc3-8683-84c7c67120fe mitre_attack_id: - T1021.002 - T1021.003 diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index a986cf92e7..59273ca788 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 15 creation_date: '2020-06-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default like N references: - https://github.com/redcanaryco/atomic-red-team/blob/4e3e9c8096dde00639a6b98845ec349135554ed5/atomics/T1208/T1208.md - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L30 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Compromised Windows Host - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 3f987809-3681-43c8-bcd8-b3ff3a28533a + - 14625569-6def-4497-99ac-8e7817105b55 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 5dde70f353..c15a28e179 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Add User Account id: 51fbcaf2-6259-11ec-b0f3-acde48001122 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting @@ -30,11 +30,14 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index a1d7ffa650..0311793793 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -2,7 +2,7 @@ name: Linux At Application Execution id: bf0a378e-5f3c-11ec-a6de-acde48001122 version: 13 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.002/T1053.002.yaml#L20 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,7 +54,7 @@ analytic_story: - Cisco Isovalent Suspicious Activity asset_type: Endpoint atomic_guid: - - 9ddf2e5e-7e2c-46c2-9940-3c2ff29c7213 + - 7266d898-ac82-4ec0-97c7-436075d0d08e mitre_attack_id: - T1053.002 product: diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 9824c54cf7..cd965ede12 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,6 +21,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index bb9a48d432..79d77ca293 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ analytic_story: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index dae8597a7a..068bfe8eca 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 9 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -22,6 +22,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Data Destruction - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 4047605305..31443e4229 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 9 creation_date: '2024-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml#L40 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ffc8b249-372a-4b74-adcd-e4c0430842de mitre_attack_id: - T1083 product: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index c6646ed32d..d47d541e84 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 11 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 576808b5d5..03d5a7c4ca 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -2,7 +2,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 13 creation_date: '2024-08-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.008/T1003.008.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - Linux Privilege Escalation - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - df1a55ae-019d-4120-bc35-94f4bc5c4b0a mitre_attack_id: - T1003.008 product: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 93512a389e..096dc9401e 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -2,7 +2,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -23,6 +23,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L63 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - AwfulShred - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 42e3a5bd-1e45-427f-aa08-2a65fa29a820 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index d0c23eb7f1..0935ded19f 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -23,6 +23,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -44,6 +45,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 7fa8e37fef..99c021d2f8 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L131 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Compromised Linux Host - QuietVault asset_type: Endpoint +atomic_guid: + - aab580c7-cc30-4a7c-b5a9-46a29066b022 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 9aa385a01a..ff3d0c76b8 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Clipboard Data Copy id: 7173b2ad-6146-418f-85ae-c3479e4515fc version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 5421e5f8f4..52c42cdbf0 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -2,7 +2,7 @@ name: Linux Curl Upload File id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf version: 13 creation_date: '2022-07-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://curl.se/docs/manpage.html - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index db17611ba4..3db2e4903f 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux DD File Overwrite id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 version: 10 creation_date: '2022-02-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Data Destruction - Industroyer2 asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index e3e800b658..500697152f 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -2,7 +2,7 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L240 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Linux Living Off The Land - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 3a15c372-67c1-4430-ac8e-ec06d641ce4d mitre_attack_id: - T1027 - T1059.004 diff --git a/detections/endpoint/linux_docker_root_directory_mount.yml b/detections/endpoint/linux_docker_root_directory_mount.yml index d055ab84d4..e5e94296a0 100644 --- a/detections/endpoint/linux_docker_root_directory_mount.yml +++ b/detections/endpoint/linux_docker_root_directory_mount.yml @@ -2,7 +2,7 @@ name: Linux Docker Root Directory Mount id: aa049566-f76a-43b9-908c-3c27e079fd43 version: 4 creation_date: '2026-03-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning status: production type: TTP @@ -41,6 +41,7 @@ known_false_positives: False positives are present based on automated tooling or references: - https://docs.docker.com/engine/storage/volumes/ - https://gtfobins.github.io/gtfobins/docker/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml#L59 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -69,6 +70,8 @@ analytic_story: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - 6c499943-b098-4bc6-8d38-0956fc182984 mitre_attack_id: - T1611 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index fa0e86065c..c117c573c2 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer Hunting id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 analytic_story: - Ingress Tool Transfer - Linux Living Off The Land @@ -41,6 +42,8 @@ analytic_story: - NPM Supply Chain Compromise - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index b56bae8e7e..de6be1e215 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer with Curl id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - XorDDos - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 254f4b5f1e..47e497dcdb 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Insert Kernel Module Using Insmod Utility id: 18b5a1a0-6326-11ec-943a-acde48001122 version: 12 creation_date: '2022-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - Linux Rootkit - Linux Privilege Escalation asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 0d1d07356f..87223e336e 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -2,7 +2,7 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://man7.org/linux/man-pages/man8/kmod.8.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L357 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - XorDDos - Linux Rootkit asset_type: Endpoint +atomic_guid: + - 034fe21c-3186-49dd-8d5d-128b35f181c7 mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_magic_sysrq_key_abuse.yml b/detections/endpoint/linux_magic_sysrq_key_abuse.yml index a11c81271a..72e51baaa8 100644 --- a/detections/endpoint/linux_magic_sysrq_key_abuse.yml +++ b/detections/endpoint/linux_magic_sysrq_key_abuse.yml @@ -2,7 +2,7 @@ name: Linux Magic SysRq Key Abuse id: 22c03600-f84a-47fa-abaa-ffbe3e72c782 version: 5 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Milad Cheraghi status: production type: TTP @@ -62,6 +62,8 @@ references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest="$dest$"' @@ -80,6 +82,9 @@ finding: analytic_story: - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 6e76f56f-2373-4a6c-a63f-98b7b72761f1 + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1059.004 - T1529 diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 5781119150..3d698d7a8c 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -2,7 +2,7 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -56,6 +57,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - f45df6be-2e1e-4136-a384-8f18ab3826fb mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index ea69099097..3fa6d9e2a5 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -2,7 +2,7 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: Filtering will be required as system administrators will references: - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098.004/T1098.004.yaml#L7 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Hellcat Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - 342cc723-127c-4d3a-8292-9c0c6b4ecadc mitre_attack_id: - T1098.004 product: diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 5a7f67486d..f41e115544 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -2,7 +2,7 @@ name: Linux System Network Discovery id: 535cb214-8b47-11ec-a2c7-acde48001122 version: 11 creation_date: '2022-02-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -65,6 +65,7 @@ known_false_positives: |- Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -91,6 +92,8 @@ analytic_story: - Industroyer2 - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index 9d3f412eb6..fae06269f2 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -2,7 +2,7 @@ name: Linux System Reboot Via System Request Key id: e1912b58-ed9c-422c-bbb0-2dbc70398345 version: 11 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html - https://cert.gov.ua/article/3718487 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - AwfulShred - Data Destruction asset_type: Endpoint +atomic_guid: + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1529 product: diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 79c9774b6e..2525ad03a2 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -2,7 +2,7 @@ name: MacOS Gatekeeper Bypass id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://ss64.com/mac/xattr.html - https://ss64.com/mac/spctl.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.001/T1553.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -75,6 +76,8 @@ analytic_story: - MacOS Post-Exploitation - MacOS Persistence Techniques asset_type: Endpoint +atomic_guid: + - fb3d46c6-9480-4803-8d7d-ce676e1f1a9b mitre_attack_id: - T1553.001 product: diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 2e6aa92273..baa8affa24 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -2,7 +2,7 @@ name: MacOS Keychains Dumped id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Jamie Windley, Splunk status: production type: TTP @@ -70,6 +70,7 @@ references: - https://gist.github.com/hfeeki/88c12f01d00534e09a84 - https://ss64.com/mac/security-keychain-settings.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1555.001/T1555.001.yaml#L6 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -94,6 +95,8 @@ intermediate_findings: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - 88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 mitre_attack_id: - T1555.001 product: diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 488af3e230..a09c47f4b1 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -2,7 +2,7 @@ name: MacOS List Firewall Rules id: f8db6e0b-55bb-40ca-bc85-2b3700adb0f8 version: 2 creation_date: '2026-04-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jamie Windley, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ known_false_positives: | references: - https://www.manpagez.com/man/8/socketfilterfw/ - https://ss64.com/mac/defaults.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L183 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" AND dest = "$dest$"' @@ -81,6 +82,8 @@ threat_objects: analytic_story: - Network Discovery asset_type: Endpoint +atomic_guid: + - ff1d8c25-2aa4-4f18-a425-fede4a41ee88 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index e5a07e40a3..f5a37a09cc 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -2,7 +2,7 @@ name: MacOS Network Share Discovery id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html - https://www.unix.com/man_page/osx/1/smbutil/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ threat_objects: analytic_story: - MacOS Post-Exploitation asset_type: Endpoint +atomic_guid: + - f94b5ad9-911c-4eff-9718-fd21899db4f7 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml index b3a93b8066..983787c0c0 100644 --- a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -2,7 +2,7 @@ name: MacOS Osascript Displaying Suspicious User Prompt id: d565ae18-7db6-460c-a2eb-a7109f18bc5e version: 1 creation_date: '2026-08-03' -modification_date: '2026-08-31' +modification_date: '2026-10-02' author: Radka Viskova, Splunk status: production type: Anomaly @@ -62,6 +62,8 @@ references: - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L31 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -83,6 +85,9 @@ threat_objects: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - b7037b89-947a-427a-ba29-e7e9f09bc045 + - 76628574-0bc1-4646-8fe2-8f4427b47d15 mitre_attack_id: - T1059.002 - T1056.002 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4155e06ea0..744d2ba42f 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production type: Hunting @@ -48,6 +48,7 @@ references: - https://twitter.com/M_haggis/status/1440758396534214658?s=20 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L39 analytic_story: - SolarWinds WHD RCE Post Exploitation - CISA AA22-320A @@ -67,6 +68,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - a50d5a97-2531-499e-a1de-5544c74432c6 mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index eddcaed3e3..59f00a04fa 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -2,7 +2,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: You will encounter noise from legitimate print-monitor registry entries. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.010/T1547.010.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - d34ef297-f178-4462-871e-9ce618d44e50 mitre_attack_id: - T1547.010 product: diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index bb6f37b475..6373999c08 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -2,7 +2,7 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa version: 7 creation_date: '2023-05-23' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -51,6 +51,7 @@ references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L166 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 4b5982ff64..6424ba1447 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -2,7 +2,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -40,6 +40,7 @@ references: - https://ss64.com/nt/nltest.html - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ - https://thedfirreport.com/2020/10/08/ryuks-return/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L16 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Ryuk Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 2e22641d-0498-48d2-b9ff-c71e496ccdbe mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 500aedd2ca..7ebf6578f5 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -2,7 +2,7 @@ name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 12 creation_date: '2021-01-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L83 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Rhysida Ransomware - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 2364e33d-ceab-4641-8468-bfb1d7cc2723 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 7c7e480067..1cc5ecc0aa 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -2,7 +2,7 @@ name: Overwriting Accessibility Binaries id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L50 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L125 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L141 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L173 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L189 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +43,13 @@ analytic_story: - Windows Privilege Escalation - Flax Typhoon asset_type: Endpoint +atomic_guid: + - 934e90cf-29ca-48b3-863c-411737ad44e3 + - 1db380da-3422-481d-a3c8-6d5770dba580 + - 5e4fa70d-c789-470e-85e1-6992b92bb321 + - 2002f5ea-cd13-4c82-bf73-e46722e5dc5e + - 825ba8ca-71cc-436b-b1dd-ea0d5e109086 + - 210be7ea-d841-40ec-b3e1-ff610bb62744 mitre_attack_id: - T1546.008 product: diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 8a3b89b114..c5982ee92c 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -2,7 +2,7 @@ name: Powershell COM Hijacking InprocServer32 Modification id: ea61e291-af05-4716-932a-67faddb6ae6f version: 10 creation_date: '2022-09-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -35,6 +36,8 @@ finding: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 48117158-d7be-441b-bc6a-d9e36e47b52b mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 2c50536886..7f5e5a62b2 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -2,7 +2,7 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 version: 17 creation_date: '2021-07-05' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,6 +92,7 @@ known_false_positives: | references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L328 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -114,6 +115,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - 6b8df440-51ec-4d53-bf83-899591c9b5d7 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index fa068b5963..cd1f780f46 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -2,7 +2,7 @@ name: PowerShell Enable PowerShell Remoting id: 40e3b299-19a5-4460-96e9-e1467f714f8e version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.006/T1021.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 9059e8de-3d7d-4954-a322-46161880b9cf mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 1b2cd0e10c..c35197e74f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -2,7 +2,7 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 version: 12 creation_date: '2021-08-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L58 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Hermetic Wiper - Data Destruction asset_type: Endpoint +atomic_guid: + - 752191b1-7c71-445c-9dbe-21bb031b18eb mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 62987dfb8e..fce9a2354d 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -2,7 +2,7 @@ name: PowerShell Get LocalGroup Discovery id: b71adfcc-155b-11ec-9413-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 979ae18953..81e3c49d6b 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 25c23b9b49..da3bad9587 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -2,7 +2,7 @@ name: PowerShell Invoke CIMMethod CIMSession id: 651ee958-a433-471c-b264-39725b788b83 version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml#L72 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Malicious PowerShell - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - adae83d3-0df6-45e7-b2c3-575f91584577 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 729331c475..3b69c4a75d 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -2,7 +2,7 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 version: 12 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Limited false positives. It is possible administrators wi references: - https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - BITS Jobs - Gozi Malware asset_type: Endpoint +atomic_guid: + - f63b8bc4-07e5-4112-acba-56f646f3f0bc mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index f7608d09ab..84b0b7eb74 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -2,7 +2,7 @@ name: PowerShell Start or Stop Service id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a version: 12 creation_date: '2023-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: This behavior may be noisy, as these cmdlets are commonly references: - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/ - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L191 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - 1f896ce4-8070-4959-8a25-2658856a70c9 mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 22b1972074..8b86ff9be6 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Process Execution via WMI id: 24869767-8579-485d-9a4f-d9ddfd8f0cac version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 795aad1726..e4b56f2824 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -2,7 +2,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 9b6a06f9-ab5e-4e8d-8289-1df4289db02f mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index a01367e425..8cd37e1aa5 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 35 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-09' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Netsh\\* OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -85,6 +86,8 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - e55be3fd-3521-4610-9d1a-e210e42dcf05 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e26ba5a7ae..10e5ebad02 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. references: - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L27 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,6 +46,10 @@ analytic_story: - Data Destruction - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - fdda2626-5234-4c90-b163-60849a24c0b8 + - 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 46996d8c89..87f0457419 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -2,7 +2,7 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 15 creation_date: '2021-10-04' -modification_date: '2026-06-09' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ known_false_positives: | references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ - https://attack.mitre.org/techniques/T1218/010/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L133 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -72,6 +73,8 @@ analytic_story: - Remcos - Suspicious Regsvr32 Activity asset_type: Endpoint +atomic_guid: + - 9d71c492-ea2e-4c08-af16-c6994cdf029f mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f27b3820a..2f1ac099df 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -2,7 +2,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ known_false_positives: The wmic.exe utility is a benign Windows application. It references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -66,6 +67,8 @@ analytic_story: - Active Directory Lateral Movement - Void Manticore asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index dd95409448..ee8f9d31a3 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c version: 12 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -25,6 +25,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1018/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L359 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 64ede6ac-b57a-41c2-a7d1-32c6cd35397d mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index ff26b5ddb9..b7f9a718a6 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -2,7 +2,7 @@ name: Remote WMI Command Attempt id: 272df6de-61f1-4784-877c-1fbc3e2d0838 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -60,6 +61,8 @@ analytic_story: - Suspicious WMI Use - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index a2952ed45c..f0450790d4 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -2,7 +2,7 @@ name: Resize ShadowStorage volume id: bc760ca6-8336-11eb-bcbb-acde48001122 version: 11 creation_date: '2021-03-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras status: production type: TTP @@ -39,6 +39,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md - https://redcanary.com/blog/blackbyte-ransomware/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L152 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - da558b07-69ae-41b9-b9d4-4d98154a7049 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 4ec87180d0..253a86ce92 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -2,7 +2,7 @@ name: Rundll32 Control RunDLL Hunt id: c8e7ced0-10c5-11ec-8b03-acde48001122 version: 10 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml - https://redcanary.com/blog/intelligence-insights-december-2021/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L250 analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 @@ -41,6 +42,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - e4c04b6f-c492-4782-82c7-3bf75eb8077e mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 3123233083..cf0aed0643 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -2,7 +2,7 @@ name: RunDLL Loading DLL By Ordinal id: 6c135f8d-5e60-454e-80b7-c56eed739833 version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, David Dorsey, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L222 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Living Off The Land - IcedID asset_type: Endpoint +atomic_guid: + - 9fd5a74b-ba89-482a-8a3e-a5feaa3697b0 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 06db197fc7..94b93cb98e 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -2,7 +2,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 28 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://www.joesandbox.com/analysis/691823/0/html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -124,6 +125,8 @@ analytic_story: - PlugX - Remcos asset_type: Endpoint +atomic_guid: + - 42f53695-ad4a-4546-abb6-7d837f644a71 mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 5d75b6e9d9..4a5ca53c4f 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -2,7 +2,7 @@ name: Scheduled Task Initiation on Remote Endpoint id: 95cf4608-4302-11ec-8194-3e22fbd008af version: 13 creation_date: '2021-11-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk, Badoodish, Github Community status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: Administrators may start scheduled tasks on remote system references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks - https://attack.mitre.org/techniques/T1053/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Medusa Ransomware - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 67d1e5a5b9..e8269ce232 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -2,7 +2,7 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 version: 20 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: David Dorsey, Mauricio Velazco, Splunk status: production type: TTP @@ -32,7 +32,8 @@ search: |- | `schtasks_scheduling_job_on_remote_system_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -68,6 +69,8 @@ analytic_story: - NOBELIUM Group - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index f061c3f6ca..90b3694e8c 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -2,7 +2,7 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 version: 13 creation_date: '2021-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -47,6 +47,7 @@ references: - https://blog.zsec.uk/paving-2-da-wholeset/ - https://msitpros.com/?p=3113 - https://adsecurity.org/?p=3466 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L82 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - Compromised Windows Host - Active Directory Kerberos Attacks asset_type: Endpoint +atomic_guid: + - e6f4affd-d826-4871-9a62-6c9004b8fe06 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 2c0b0f9eb9..d382049a83 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -2,7 +2,7 @@ name: Shim Database File Creation id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L44 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aefd6866-d753-431f-a7a4-215ca7e3f13d mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index d7bacbc89b..cc68f93c14 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -2,7 +2,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Persistence Techniques - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 9ab27e22-ee62-4211-962b-d36d9a0e6a18 mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index a54276b474..e645476aa6 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -2,7 +2,7 @@ name: Short Lived Windows Accounts id: b25f6f62-0782-43c1-b403-083231ffd97d version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Bhavin Patel, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: It is possible that an administrator created and deleted references: - https://www.youtube.com/watch?v=D4Cd-KK4ctk - https://attack.mitre.org/techniques/T1078/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$dest$" and "$src_user$" search: '%original_detection_search% | search dest = "$dest$" src_user = "$src_user$"' @@ -57,6 +59,9 @@ analytic_story: - Active Directory Lateral Movement - GhostRedirector IIS Module and Rungan Backdoor asset_type: Windows +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1078.003 - T1136.001 diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml index bb94157473..18647c0001 100644 --- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml +++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml @@ -2,7 +2,7 @@ name: Steal or Forge Authentication Certificates Behavior Identified id: 87ac670e-bbfd-44ca-b566-44e9f835518d version: 9 creation_date: '2023-05-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Correlation @@ -22,6 +22,9 @@ known_false_positives: False positives may be present based on automated tooling references: - https://research.splunk.com/stories/windows_certificate_services/ - https://attack.mitre.org/techniques/T1649/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L351 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$risk_object$" search: '%original_detection_search% | search risk_object = "$risk_object$"' diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index f6d9862104..a06f18a25f 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -2,7 +2,7 @@ name: Suspicious microsoft workflow compiler usage id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 version: 13 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ known_false_positives: Although unlikely, limited instances have been identified references: - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L112 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Trusted Developer Utilities Proxy Execution - Living Off The Land asset_type: Endpoint +atomic_guid: + - 7cbb0f26-a4c1-4f77-b180-a009aa05637e mitre_attack_id: - T1127 product: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index d175f3d219..abb3eb65e5 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -2,7 +2,7 @@ name: Suspicious mshta child process id: 60023bb6-5500-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Teoderick Contreras Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Although unlikely, some legitimate applications may exhib references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Lumma Stealer - MuddyWater asset_type: Endpoint +atomic_guid: + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 36c2cd036e..f563ea52fd 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -2,7 +2,7 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: - https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Disabling Security Tools - DHS Report TA18-074A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 9be3b0f530..eae3bc1abe 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -2,7 +2,7 @@ name: Suspicious Rundll32 StartW id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 version: 15 creation_date: '2021-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1036 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/ - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L195 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -62,6 +63,8 @@ analytic_story: - Graceful Wipe Out Attack - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - ae3a8605-b26e-457c-b6b3-2702fd335bac mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index bde70a84a0..09efb091a4 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -2,7 +2,7 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f version: 22 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -71,6 +71,7 @@ how_to_implement: |- known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -107,6 +108,8 @@ analytic_story: - Storm-0501 Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index e762a05487..1cda3a4ce3 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -2,7 +2,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 16 creation_date: '2020-10-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators debugging servers references: - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +53,10 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Windows +atomic_guid: + - 66703791-c902-4560-8770-42b8a91f7667 + - 85cfbf23-4a1e-4342-8792-007e004b975f + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 34973c0d0a..1de08f7f7e 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -2,7 +2,7 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d version: 18 creation_date: '2019-10-16' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,6 +43,7 @@ known_false_positives: This detection may require tuning based on third party ap references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml - https://attack.mitre.org/techniques/T1036/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Windows Error Reporting Service Elevation of Privilege Vulnerability - DarkGate Malware asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 product: diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 92519700db..f2f2511cf5 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -2,7 +2,7 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -34,10 +34,15 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Active Directory Discovery - Medusa Ransomware asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 63850b2cd6..0761ee9525 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -2,7 +2,7 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L236 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Disabling Security Tools asset_type: Endpoint +atomic_guid: + - 811b3e76-c41b-430c-ac0d-e2380bfaa164 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 0d800ec0e7..57b0d50680 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 70f9d59fb9..5d3c9681ab 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell Script Block id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,9 +25,12 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index c40e3ee411..634a025820 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -2,7 +2,7 @@ name: USN Journal Deletion id: b6e0ff70-b122-4227-9368-4cf322ab43c3 version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Windows Log Manipulation - Ransomware asset_type: Endpoint +atomic_guid: + - b4115c7a-0e92-47f0-a61e-17e7218b2435 mitre_attack_id: - T1070 product: diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 5993128843..2667b4b122 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -2,7 +2,7 @@ name: WBAdmin Delete System Backups id: cd5aed7e-5cea-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -38,6 +38,7 @@ references: - https://attack.mitre.org/techniques/T1490/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin - https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L108 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 584331dd-75bc-4c02-9e0b-17f5fd81c748 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cee3e655c7..f13ca4cd96 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -2,7 +2,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 version: 24 creation_date: '2022-09-05' -modification_date: '2026-08-14' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.001/T1134.001.yaml#L20 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -55,6 +56,8 @@ analytic_story: - Salat Stealer - Vidar Stealer asset_type: Endpoint +atomic_guid: + - 34f0a430-9d04-4d98-bcb5-1989f14719f0 mitre_attack_id: - T1134.002 product: diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 45150fe211..7ad5873bbb 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -2,7 +2,7 @@ name: Windows AD DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 10 creation_date: '2022-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: TTP @@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. references: - https://adsecurity.org/?p=1714 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml#L533 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Sneaky Active Directory Persistence Tricks - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - d5b886d9-d1c7-4b6e-a7b0-460041bf2823 mitre_attack_id: - T1098 product: diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 61a8f0b0b9..e03658266c 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -2,7 +2,7 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f version: 14 creation_date: '2020-12-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -66,6 +66,12 @@ references: - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption - https://www.joeware.net/freetools/tools/adfind/index.htm - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L71 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L96 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L121 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L146 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L399 drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' diff --git a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml index f050a23a17..f592593562 100644 --- a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml +++ b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml @@ -2,7 +2,7 @@ name: Windows Application Whitelisting Bypass Attempt via Rundll32 id: 1ef5dab0-e1f1-495d-a272-d134583c10b1 version: 6 creation_date: '2021-02-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,10 @@ references: - https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/ - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L59 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L85 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L112 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L138 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -96,6 +100,11 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - d91cae26-7fc1-457b-a854-34c8aad48c89 + - 5e46a58e-cbf6-45ef-a289-ed7754603df9 + - 41fa324a-3946-401e-bbdd-d7991c628125 + - 71d771cd-d6b3-4f34-bc76-a63d47a10b19 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index a0612d605f..bb97038567 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -2,7 +2,7 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 version: 12 creation_date: '2020-04-29' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L306 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - Azorult - Trickbot asset_type: Endpoint +atomic_guid: + - a1230893-56ac-4c81-b644-2108e982f8f5 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index 68c633e1c8..8e479ce37e 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Autostart Execution LSASS Driver Registry Modification id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a version: 10 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: False positives may be present on recent Windows Operatin references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.008/T1547.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ finding: analytic_story: - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8ecef16d-d289-46b4-917b-0dba6dc81cf1 mitre_attack_id: - T1547.008 product: diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index c9afe2a0c6..53232bd57e 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -2,7 +2,7 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://attack.mitre.org/techniques/T1218/013/ - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - c426dacf-575d-4937-8611-a148a86a5e61 mitre_attack_id: - T1218.013 product: diff --git a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml index 8d6ee95eb7..d732490e0a 100644 --- a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml +++ b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml @@ -2,7 +2,7 @@ name: Windows Cabinet File Extraction Via Expand id: 4e3e3b8c-6d3a-4b47-9f5a-9e3e0a0a6f2f version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: | and sanctioned paths. references: - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - APT37 Rustonotto and FadeStealer - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 9f8b1c54-cb76-4d5e-bb1f-2f5c0e8f5a11 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml index 8dfa4e8e9e..8eb5a955e0 100644 --- a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml +++ b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml @@ -2,7 +2,7 @@ name: Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script id: 59a8662f-f616-4494-8fa1-29ae77fc2018 version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Certain administrative or security testing activities in Azure AD environments may use ConvertTo-AADIntBackdoor for legitimate federation configuration changes. Review and allow such actions from trusted administrators and approved tools. references: - https://atomicredteam.io/privilege-escalation/T1484.002/#atomic-test-1---add-federation-to-azure-ad + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1484.002/T1484.002.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -53,6 +54,8 @@ analytic_story: - Azure Active Directory Account Takeover - Azure Active Directory Privilege Escalation asset_type: Endpoint +atomic_guid: + - 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7 mitre_attack_id: - T1482 - T1078 diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index b836178454..e19c0130d9 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -2,7 +2,7 @@ name: Windows Create Local Account id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb version: 13 creation_date: '2022-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,8 @@ known_false_positives: | Restrict to critical infrastructure to reduce any volume. references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index c424345a12..65e79e9e66 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -2,7 +2,7 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -31,7 +31,8 @@ search: |- | `windows_create_local_administrator_account_via_net_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 3b24d5c345..7003854e61 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -2,7 +2,7 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives may be present if an application is dumping processes, filter as needed. Recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-11---dump-lsass-with-createdumpexe-from-net-v5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L308 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Credential Dumping - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index d17aeac465..fab377f7cf 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -2,7 +2,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 version: 22 creation_date: '2021-10-19' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://attack.mitre.org/techniques/T1105/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -105,6 +106,8 @@ analytic_story: - Salt Typhoon - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - 2b080b99-0deb-4d51-af0f-833d37c4ca6a mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 6b6034e879..5c630ac4f3 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -2,7 +2,7 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 version: 18 creation_date: '2021-11-10' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -52,6 +52,7 @@ references: - https://everything.curl.dev/usingcurl/uploads - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 - https://twitter.com/d1r4c/status/1279042657508081664?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - PromptLock - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 9aae252470..fa335865bf 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - d4a6da40-618f-454d-9a9e-26af552aaeb0 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 273cf3e274..39eb28b1de 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ - https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L274 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 3dacb0d2-46ee-4c27-ac1b-f9886bf91a56 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 2471f81624..160d9a9755 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -16,6 +16,7 @@ references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp - https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L244 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - e246578a-c24d-46a7-9237-0213ff86fb0c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b1091f67a9..22cc088717 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -28,6 +28,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - c0d6d67f-1f63-42cc-95c0-5fd6b20082ad mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index a9dbf0aa07..a9d21b8e66 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -51,6 +51,7 @@ known_false_positives: |- In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L230 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 6e0d1131-2d7e-4905-8ca5-d6172f05d03d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 904f5374cb..cc5b1ad88f 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 version: 15 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -32,6 +32,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 8e2ea14afc..e39c448c01 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,6 +16,13 @@ references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis - https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L288 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L318 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L333 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L348 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L363 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L393 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +44,14 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 93386d41-525c-4a1b-8235-134a628dee17 + - ffbb407e-7f1d-4c95-b22e-548169db1fbd + - a450e469-ba54-4de1-9deb-9023a6111690 + - 5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4 + - 12f50e15-dbc6-478b-a801-a746e8ba1723 + - d29b7faf-7355-4036-9ed3-719bd17951ed + - 4d72d4b1-fa7b-4374-b423-0fe326da49d2 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index ab31e349ec..7bc79a33f8 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 13 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -39,6 +41,9 @@ analytic_story: - Windows Defense Evasion Tactics - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 1f6743da-6ecc-4a93-b03f-dc357e4b313f + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index c5a13db2c6..b0f9bd96ab 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -2,7 +2,7 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 version: 15 creation_date: '2021-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. references: - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L608 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - 871438ac-7d6e-432a-b27d-3e7db69faf58 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index f151287086..21e2d8dc1d 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -2,7 +2,7 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 version: 13 creation_date: '2022-08-19' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -14,12 +14,15 @@ how_to_implement: The search is written against the latest Sysmon TA 4.0 https:/ known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: - https://hijacklibs.net + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.001/T1574.001.yaml#L67 analytic_story: - Qakbot - Windows Defense Evasion Tactics - Living Off The Land - Malicious Inno Setup Loader asset_type: Endpoint +atomic_guid: + - 65526037-7079-44a9-bda1-2cb624838040 mitre_attack_id: - T1574.001 product: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index eee16bce84..fe022fd4bb 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 version: 15 creation_date: '2022-01-20' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -99,6 +100,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml index 35796b2a16..823b3c0e1d 100644 --- a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml +++ b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml @@ -2,7 +2,7 @@ name: Windows Entra User Management Via Azure CLI id: f6332409-abeb-42f8-b6a7-76201bdc7a0a version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ known_false_positives: Legitimate IT administrators commonly use the Azure CLI f references: - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.003/T1136.003.yaml#L67 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -72,6 +73,8 @@ threat_objects: analytic_story: - Azure Active Directory Persistence asset_type: Endpoint +atomic_guid: + - 228c7498-be31-48e9-83b7-9cb906504ec8 mitre_attack_id: - T1136 - T1078.004 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 86a7ddb47f..6271efedb5 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -2,7 +2,7 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 version: 11 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.002/T1136.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2024-37085 +atomic_guid: + - fcec2963-9951-4173-9bfa-98d8b7834e62 mitre_attack_id: - T1136.002 - T1136.001 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 62f1270f73..9998dbbd77 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -2,7 +2,7 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 21 creation_date: '2019-10-16' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -26,6 +26,7 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Clop Ransomware - Salat Stealer asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml index d6d0895a37..db584fffad 100644 --- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml +++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml @@ -2,7 +2,7 @@ name: Windows Event Logging Service Has Shutdown id: d696f622-6b08-4336-b456-696cb5b43ba0 version: 7 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -27,12 +27,17 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L149 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 8e81d090-0cd6-4d46-863c-eec11311298f + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index 4c2862a4dd..c6c2369d6f 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -2,7 +2,7 @@ name: Windows Event Triggered Image File Execution Options Injection id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4 version: 8 creation_date: '2022-09-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -22,9 +22,12 @@ known_false_positives: False positives may be present and tuning will be require references: - https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index 836c6880c5..3a9363e33c 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -2,7 +2,7 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 version: 8 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -68,6 +68,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -94,6 +95,8 @@ analytic_story: - CISA AA23-347A - ShrinkLocker asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml index fde7bd5856..2eb87319c4 100644 --- a/detections/endpoint/windows_export_certificate.yml +++ b/detections/endpoint/windows_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Export Certificate id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714 version: 11 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, you must collect Microsoft-Windows known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export. references: - https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -40,6 +41,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index b8105a3497..1c1e9b3c7c 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,8 @@ references: - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L190 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -78,6 +80,9 @@ analytic_story: - CISA AA22-277A - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - dd3b61dd-7bbc-48cd-ab51-49ad1a776df0 + - ffd492e3-0455-4518-9fb1-46527c9f241b mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 72f19c64fe..1139e23386 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -42,6 +42,7 @@ references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L816 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -88,6 +89,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - c01cad7f-7a4c-49df-985e-b190dcf6a279 mitre_attack_id: - T1059.001 - T1105 diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index f3e57138ae..0f2792ccfe 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -2,7 +2,7 @@ name: Windows File Share Discovery With Powerview id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c version: 11 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L134 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -52,6 +53,8 @@ analytic_story: - Active Directory Privilege Escalation - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - d07e4cc1-98ae-447e-9d31-36cb430d28c4 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index a466d49437..6d31c42dee 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -2,7 +2,7 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L31 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -61,7 +62,7 @@ analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint atomic_guid: - - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 + - a8206bcc-f282-40a9-a389-05d9c0263485 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml index 1a5db7d7c1..137faa5a6c 100644 --- a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml +++ b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml @@ -2,7 +2,7 @@ name: Windows Get-Variable.EXE Execution from WindowsApps Folder id: 7edb95b6-bccf-4d8c-8ada-d1c5520cf0ed version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives. references: - https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.008/T1574.008.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 1561de08-0b4b-498e-8261-e922f3494aae mitre_attack_id: - T1574.008 product: diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index eb0a473e80..1e10212df4 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -2,7 +2,7 @@ name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 7 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Mauricio Velazco, Splunk status: production type: Hunting @@ -20,6 +20,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L21 analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Discovery Techniques @@ -35,6 +36,8 @@ analytic_story: - Volt Typhoon - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 1f454dd6-e134-44df-bebb-67de70fb6cd8 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml index 47471c91e4..3fabe37f10 100644 --- a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml +++ b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml @@ -2,7 +2,7 @@ name: Windows Guest Account Enabled Via Net.EXE id: 4f8cd681-7583-47a0-9f38-6337b7adf48a version: 2 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,8 @@ search: |- | `windows_guest_account_enabled_via_net_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The Windows guest account may be activated by IT or support teams for temporary access or troubleshooting. Filter activations related to authorized maintenance activities to reduce false alerts. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1078.001/T1078.001.yaml#L51 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +61,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aa6cb8c4-b582-4f8e-b677-37733914abda mitre_attack_id: - T1078.001 product: diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9c1505e46..7c39c7ede9 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ known_false_positives: False positives will be present and filtering is required references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -90,6 +91,8 @@ analytic_story: - Cisco Network Visibility Module Analytics - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index e6477a71bc..fc2a6a8825 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -2,7 +2,7 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 version: 11 creation_date: '2022-07-12' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -38,9 +38,12 @@ references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L84 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - db020456-125b-4c8b-a4a7-487df8afb5a2 mitre_attack_id: - T1059 product: diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index 7d94f63810..3fbc5d7fbc 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -2,7 +2,7 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 version: 14 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -36,6 +36,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml index f23fda7fc0..e9e7758e4c 100644 --- a/detections/endpoint/windows_iis_components_new_module_added.yml +++ b/detections/endpoint/windows_iis_components_new_module_added.yml @@ -2,7 +2,7 @@ name: Windows IIS Components New Module Added id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e version: 11 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml index 15a6f78e8d..bfc8e823e9 100644 --- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml +++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable Auto Logger Session id: dc6a5613-d024-47e7-9997-ab6477a483d3 version: 9 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://isc.sans.edu/diary/rss/28628 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1201 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +38,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 653c6e17-14a2-4849-851d-f1c0cc8ea9ab mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 01a1484164..9e676c6e08 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable HVCI id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 version: 11 creation_date: '2023-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L913 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index de6a411fc9..3ba7218fe8 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Sim references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Living Off The Land - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 296099e1af..3cbdbe4f1c 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Fi references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ finding: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - cecfea7a-5f03-4cdd-8bc8-6f7c22862440 mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index ef5bbd798f..c514963b3e 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -2,7 +2,7 @@ name: Windows Indirect Command Execution Via Series Of Forfiles id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be version: 11 creation_date: '2022-12-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index f770c33e4d..8353103cd7 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -2,7 +2,7 @@ name: Windows Input Capture Using Credential UI Dll id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e version: 9 creation_date: '2022-08-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,10 +15,13 @@ known_false_positives: this module can be loaded by a third party application. F references: - https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L16 analytic_story: - Brute Ratel C4 - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 mitre_attack_id: - T1056.002 product: diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 9bbc67e9c5..76c2205081 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 version: 12 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -19,6 +19,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 559e6d06-bb42-4307-bff7-3b95a8254bad mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 9212841d13..52534c68fd 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L265 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Compromised Windows Host - Signed Binary Proxy Execution InstallUtil asset_type: Endpoint +atomic_guid: + - 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b mitre_attack_id: - T1218.004 product: diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f6cb824804..03d828f638 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -2,7 +2,7 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://twitter.com/0gtweet/status/1564968845726580736?s=20 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-45D28FB47E9B6ACC5DCA9FDA3E790210.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 68e4ad1895..87f0252f6b 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -2,7 +2,7 @@ name: Windows Linked Policies In ADSI Discovery id: 510ea428-4731-4d2f-8829-a28293e427aa version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L247 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 7ab0205a-34e4-4a44-9b04-e1541d1a57be mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 53147d54e3..710e1709cc 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -2,7 +2,7 @@ name: Windows Mimikatz Crypto Export File Extensions id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16 version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume. references: - https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_crypto.c#L628-L645 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index c2284f8abb..8dcdd84b19 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry AuthenticationLevelOverride id: 6410a403-36bb-490f-a06a-11c3be7d2a41 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1061 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 7e7b62e9-5f83-477d-8935-48600f38a3c6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 081b122594..d7edff1a2b 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Auto Update Notif id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L835 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 335a6b15-b8d2-4a3f-a973-ad69aa2620d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index b56ea1e175..df4afcc733 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable RDP id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1 version: 10 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1138 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - ShrinkLocker - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - 5f8e36de-37ca-455e-b054-a2584f043c06 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index a0e28655d9..37ad657434 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Toast Notifications id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L563 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 003f466a-6010-4b15-803a-cbb478a314d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 48861e46a9..09e6f55681 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Win Defender Raw Write Notif id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index da42d17dcd..906d72ca7f 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable WinDefender Notifications id: 8e207707-ad40-4eb3-b865-3a52aec91f26 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index cf6e6e234c..d50a14b0a6 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L577 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 45914594-8df6-4ea9-b3cc-7eb9321a807e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index 101583af23..d7047f51b8 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableRemoteDesktopAntiAlias id: 4927c6f1-4667-42e6-bd7a-f5222116386b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L994 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 61d35188-f113-4334-8245-8c6556d43909 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 8bbf7c9586..1fd32a56a8 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableSecuritySettings id: 989019b4-b7aa-418a-9a17-2293e91288b6 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1007 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - DarkGate Malware - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 4b81bcfa-fb0a-45e9-90c2-e3efe5160140 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index afb52af6c2..c605fa982f 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disabling WER Settings id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L675 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - d2c9e41e-cd86-473d-980d-b6403562e3e1 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index fe7158b200..7f81388678 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisAllow Windows App id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L692 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 71db768a-5a9c-4047-b5e7-59e01f188e84 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index 0f7a6e5632..4fcbff8da4 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Do Not Connect To Win Update id: e09c598e-8dd0-4e73-b740-4b96b689199e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L848 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - d1de3767-99c2-4c6c-8c5a-4ba4586474c8 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index d020f7be17..26351e0a9f 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DontShowUI id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1020 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 09147b61-40f6-4b2a-b6fb-9e73a3437c96 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index 013437ecd0..343b7fed61 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry EnableLinkedConnections id: 93048164-3358-4af0-8680-aa5f38440516 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index cb58e89edb..ae6f6a9182 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry LongPathsEnabled id: 36f9626c-4272-4808-aadd-267acce681c0 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 77dae0130f..420b4c9681 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry MaxConnectionPerServer id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec version: 11 creation_date: '2023-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://asec.ahnlab.com/en/17692/ - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L890 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Warzone RAT asset_type: Endpoint +atomic_guid: + - 37950714-e923-4f92-8c7c-51e4b6fffbf6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index f99e065abb..6d6fd1e86f 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Reboot With Logon User id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L822 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 396f997b-c5f8-4a96-bb2c-3c8795cf459d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 566ad5c946..4c332ede53 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Update id: fbd4f333-17bb-4eab-89cb-860fa2e0600e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L809 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 01b20ca8-c7a3-4d86-af59-059f15ed5474 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index 9c46c0f4a7..14c926a049 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry on Smart Card Group Policy id: 1522145a-8e86-4f83-89a8-baf62a8f489d version: 9 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1151 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - ShrinkLocker asset_type: Endpoint +atomic_guid: + - 4c4bf587-fe7f-448f-ba8d-1ecec9db88be mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index 792d6146df..13261230da 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyEnable id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5 version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1034 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - eb0ba433-63e5-4a8c-a9f0-27c4192e1336 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index c94161b865..edfd77e587 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyServer id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1047 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - d88a3d3b-d016-4939-a745-03638aafd21b mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 32a3377cb7..302cd984a9 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L591 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - c30dada3-7777-4590-b970-dc890b8cf113 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index a1444c7c9f..9dcb2e5c5d 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L861 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 3b625eaa-c10d-4635-af96-3eae7d2a2f3c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 377bb7c4cf..014065e302 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 15 creation_date: '2022-03-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L498 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 795d3248-0394-4d4d-8e86-4e8df2a2693f mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 00b2ebf2c3..28d2662d68 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 version: 13 creation_date: '2022-07-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - https://www.sakshamdixit.com/wmi-events/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 3d5d572865..ed67803245 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L253 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ analytic_story: - Windows System Binary Proxy Execution MSIExec - Water Gamayun asset_type: Endpoint +atomic_guid: + - 0106ffa5-fab6-4c7d-82e3-e6b8867d5e5d mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index b6fc68b795..bfb1bd01bf 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ known_false_positives: | references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 5886cd3166..8d9f150a6b 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L281 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint +atomic_guid: + - ab09ec85-4955-4f9c-b8e0-6851baf4d47f mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index 2776bccf2e..907bc7ac7d 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -2,7 +2,7 @@ name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 13 creation_date: '2021-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -22,6 +22,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1110.003/T1110.003.yaml#L55 drilldown_searches: - name: View the detection results for - "$Workstation$" search: '%original_detection_search% | search Workstation = "$Workstation$"' @@ -41,6 +42,8 @@ analytic_story: - Active Directory Password Spraying - Volt Typhoon asset_type: Endpoint +atomic_guid: + - f14d956a-5b6e-4a93-847f-0c415142f07d mitre_attack_id: - T1110.003 product: diff --git a/detections/endpoint/windows_net_system_service_discovery.yml b/detections/endpoint/windows_net_system_service_discovery.yml index db8ca969a5..78a2d60424 100644 --- a/detections/endpoint/windows_net_system_service_discovery.yml +++ b/detections/endpoint/windows_net_system_service_discovery.yml @@ -2,7 +2,7 @@ name: Windows Net System Service Discovery id: dd7da098-83b8-4c48-b09d-e51aeb621e81 version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml#L20 analytic_story: - LAMEHUG - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3 mitre_attack_id: - T1007 product: diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 31f9444cb5..dc8554eb1b 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -2,7 +2,7 @@ name: Windows Network Share Interaction Via Net id: e51fbdb0-0be0-474f-92ea-d289f71a695e version: 7 creation_date: '2024-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: Hunting @@ -36,13 +36,16 @@ how_to_implement: The detection is based on data originating from either Endpoin known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L79 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L5 analytic_story: - Active Directory Discovery - Active Directory Privilege Escalation - Network Discovery asset_type: Endpoint atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae + - 20f1097d-81c1-405c-8380-32174d493bbb + - 3386975b-367a-4fbb-9d77-4dcf3639ffd3 mitre_attack_id: - T1135 - T1039 diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml index 66ede70c61..c2688a50b9 100644 --- a/detections/endpoint/windows_network_sniffing_tool_executed.yml +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -2,7 +2,7 @@ name: Windows Network Sniffing Tool Executed id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f version: 1 creation_date: '2026-07-30' -modification_date: '2026-07-30' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -51,6 +51,8 @@ known_false_positives: |- Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L86 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L154 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -80,6 +82,9 @@ analytic_story: - Windows Discovery Techniques - Network Discovery asset_type: Endpoint +atomic_guid: + - a5b2f6a0-24b4-493e-9590-c699f75723ca + - c67ba807-f48b-446e-b955-e4928cd1bf91 mitre_attack_id: - T1040 product: diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index 7f45ca027a..428bde53f8 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -2,7 +2,7 @@ name: Windows New Custom Security Descriptor Set On EventLog Channel id: c0e5dd5a-2117-41d5-a04c-82a762a86a38 version: 9 creation_date: '2023-01-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. a l references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a0cb81f8-44d0-4ac4-a8f3-c5c7f43a12c1 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 34dff0237d..e8905ea4a0 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -2,7 +2,7 @@ name: Windows New EventLog ChannelAccess Registry Value Set id: 16eb11bc-ef42-42e8-9d0c-d21e0fa15725 version: 8 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may be triggered from newly installed eve references: - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 7954dc5dcc..b91a5c4c4c 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -2,7 +2,7 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 version: 12 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: False positives should be limited as it is specific to Ad references: - http://www.nirsoft.net/utils/advanced_run.html - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 41f70c1871..eb146d19cc 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -2,7 +2,7 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 version: 11 creation_date: '2022-01-24' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -38,10 +38,13 @@ references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 9b2389e4f6..902254e559 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -2,7 +2,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 version: 14 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index c6541e4295..600ac7ab14 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Hunting id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,14 @@ known_false_positives: False positives will be present as this is meant to assis references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index c1e6eb0696..73a269d2df 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index cfb0efbea3..9a9028cbaf 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index 8793cec91b..775ca98864 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 version: 9 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may occur if legitimate Outlook processes references: - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 - https://github.com/trustedsec/specula/wiki + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1137.004/T1137.004.yaml#L6 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - 7a91ad51-e6d2-4d43-9471-f26362f5738e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index a287671fc9..d12ab3f3c1 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -2,7 +2,7 @@ name: Windows Parent PID Spoofing with Explorer id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1 version: 13 creation_date: '2022-05-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://x.com/CyberRaiju/status/1273597319322058752?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.004/T1134.004.yaml#L90 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - cbbff285-9051-444a-9d17-c07cd2d230eb mitre_attack_id: - T1134.004 product: diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 9d8d8f1839..c4dc611bb0 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -2,7 +2,7 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 version: 15 creation_date: '2022-01-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - CISA AA22-257A - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index 13be42e2d9..47ae84c3fc 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Disable HTTP Logging id: 27958de0-2857-43ca-9d4c-b255cf59dcab version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index 1ca8088791..11d6e2368d 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export Certificate id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 891c3a563f..d497c1abb9 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c version: 14 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Certificate Services - Water Gamayun asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index d1d0f0aa91..e023cb7ee9 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Get CIMInstance Remote Computer id: d8c972eb-ed84-431a-8869-ca4bd83257d1 version: 11 creation_date: '2023-03-27' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1104 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - ac494fe5-81a4-4897-af42-e774cf005ecb mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index 82cf168718..e81a5f975e 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -2,7 +2,7 @@ name: Windows PowerShell IIS Components WebGlobalModule Usage id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57 version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L39 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -49,6 +50,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - IIS Components asset_type: Endpoint +atomic_guid: + - cc3381fb-4bd0-405c-a8e4-6cacfac3b06c mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index dc161addef..2a5eed3da2 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -2,7 +2,7 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc version: 14 creation_date: '2023-06-12' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Benign administrative tasks can also trigger alerts, nece references: - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L78 drilldown_searches: - name: View the detection results for - "$Computer$" and "$user_id$" search: '%original_detection_search% | search Computer = "$Computer$" user_id = "$user_id$"' diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index cbff0e938d..750c9d8558 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -2,7 +2,7 @@ name: Windows PowerView Kerberos Service Ticket Request id: 970455a1-4ac2-47e1-a9a5-9e75443ddcb9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting - https://attack.mitre.org/techniques/T1558/003 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L129 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Active Directory Kerberos Attacks - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - 902f4ed2-1aba-4133-90f2-cff6d299d6da mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 0f29361b67..1d1515e80c 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Netsh id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index 23e5d18f0e..11bd729a26 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Registry id: 0270455b-1385-4579-9ac5-e77046c508ae version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 4e2d65a357..c730c2797a 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -2,7 +2,7 @@ name: Windows Registry BootExecute Modification id: eabbac3a-45aa-4659-920f-6b8cff383fb8 version: 12 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will need to be filtered. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L404 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Windows BootKits asset_type: Endpoint +atomic_guid: + - 6e1666d5-3f2b-4b9a-80aa-f011322380d4 mitre_attack_id: - T1542 - T1547.001 diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index c1eb7a475b..5cd9cd3a76 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -2,7 +2,7 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 version: 12 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teodeerick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives will be limited to a legitimate business references: - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.004/T1553.004.yaml#L116 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Drivers - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 76f49d86-5eb1-461a-a032-a480f86652f1 mitre_attack_id: - T1553.004 product: diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d09656e864..fb9e911b68 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -2,7 +2,7 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df version: 11 creation_date: '2021-10-07' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -42,6 +42,10 @@ references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://attack.mitre.org/techniques/T1562/006/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1621 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1630 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1639 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1649 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +71,11 @@ analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - fdac1f79-b833-4bab-b4a1-11b1ed676a4b + - b42c1f8c-399b-47ae-8fd8-763181395fee + - 110b4281-43fe-405f-a184-5d8eaf228ebf + - 4d61779d-be7f-425c-b560-0cafb2522911 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index f5d8d1aea6..dcafbddd16 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -2,7 +2,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 version: 14 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md - https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L533 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L548 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +39,9 @@ analytic_story: - Windows Registry Abuse - Windows Drivers asset_type: Endpoint +atomic_guid: + - 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5 + - c173c948-65e5-499c-afbe-433722ed5bd4 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 644c9a5227..9feb7c268c 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -2,7 +2,7 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. references: - https://attack.mitre.org/techniques/T1543/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L145 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - fb4151a2-db33-4f8c-b7f8-78ea8790f961 mitre_attack_id: - T1543.003 product: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index f0b4a4123e..924a74e51c 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -2,7 +2,7 @@ name: Windows Root Domain linked policies Discovery id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 00c652e2-0750-4ca6-82ff-0204684a6fe4 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 7768f86cb8..035fa47145 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -2,7 +2,7 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a version: 11 creation_date: '2024-11-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -17,6 +17,7 @@ references: - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L79 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml index cc80df82e7..6f28e04550 100644 --- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml +++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml @@ -2,7 +2,7 @@ name: Windows ScManager Security Descriptor Tampering Via Sc.EXE id: 04023928-0381-4935-82cb-03372b2ef644 version: 9 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/8ac5c4f84692b11ea2832d18d3dc6f1ce7fb4e41/atomics/T1569.002/T1569.002.md#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet - https://0xv1n.github.io/posts/scmanager/ - https://attack.mitre.org/techniques/T1569/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L208 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - bf07f520-3909-4ef5-aa22-877a50f2f77b mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 352d9aea29..0628f561cc 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Group Discovery With Net id: d9eb7cda-5622-4722-bc88-7f2442f4b5af version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ references: - https://adsecurity.org/?p=3658 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L35 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - IcedID - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 0afb5163-8181-432e-9405-4322710c0c37 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index c4d05fdf28..37af44ada5 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e version: 11 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -49,6 +49,8 @@ references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L176 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -85,6 +87,9 @@ analytic_story: - Windows Registry Abuse - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 5c2571d0-1572-416d-9676-812e64ca9f44 + - 21df41be-cdd8-4695-a650-c3981113aa3c mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 3e5a52271b..7702b9a3d6 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -2,7 +2,7 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 version: 15 creation_date: '2023-03-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may arise in the RDP Hijacking analytic w references: - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1563.002/T1563.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Compromised Windows Host - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - a37ac520-b911-458e-8aed-c5f1576d9f46 mitre_attack_id: - T1543.003 - T1563.002 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index f2509cb3cc..6a955fbe97 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -2,7 +2,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 version: 20 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Third party tools may used this technique to create services but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.011/T1574.011.yaml#L22 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Brute Ratel C4 - Gh0st RAT asset_type: Endpoint +atomic_guid: + - f38e9eea-e1d7-4ba6-b716-584791963827 mitre_attack_id: - T1574.011 product: diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index be8ac4dd2b..a98b4246e4 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -2,7 +2,7 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 8 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ known_false_positives: False positives may be present based on Administrative us references: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - https://github.com/kavika13/RemCom + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L158 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a5d8cdeb-be90-43a9-8b26-cc618deac1e0 mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index 6008781baf..800a48499c 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -2,7 +2,7 @@ name: Windows Service Stop Attempt id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 version: 8 creation_date: '2022-11-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L25 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 41274289-ec9c-4213-bea4-e43c4aa57954 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 62ee6a8643..7f30fc9011 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L208 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index 6dd8cab6f1..58cf6a4b3c 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Kernel Driver Comadmin id: 628d9c7c-3242-43b5-9620-7234c080a726 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present, filter as needed. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L110 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index f4a4d3beb9..8b662a65d1 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd version: 11 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L876 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index ec9bf5438b..9417bdc3bd 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Service Create id: 64eb091f-8cab-4b41-9b09-8fb4942377df version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_sqlcmd_execution.yml b/detections/endpoint/windows_sqlcmd_execution.yml index 4933040903..05f388a905 100644 --- a/detections/endpoint/windows_sqlcmd_execution.yml +++ b/detections/endpoint/windows_sqlcmd_execution.yml @@ -2,7 +2,7 @@ name: Windows SQLCMD Execution id: 4e7c2f85-8f02-4bd2-a48b-5ec98a2c5f72 version: 5 creation_date: '2025-02-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -28,10 +28,13 @@ references: - https://attack.mitre.org/techniques/T1213/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md#atomic-test-32---file-download-with-sqlcmdexe - https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L900 analytic_story: - SQL Server Abuse - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 6934c16e-0b3a-4e7f-ab8c-c414acd32181 mitre_attack_id: - T1059.003 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index f4c330f6da..88962307ce 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates CryptoAPI id: 905d5692-6d7c-432f-bc7e-a6b4f464d40e version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, one will need to enable the Micros known_false_positives: False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Windows Certificate Services - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index 0b54ae8603..c1ba66028d 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index bdddbd2124..703769f961 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml index 1618c7539e..26d5dd4564 100644 --- a/detections/endpoint/windows_subinacl_execution.yml +++ b/detections/endpoint/windows_subinacl_execution.yml @@ -2,7 +2,7 @@ name: Windows SubInAcl Execution id: 12491419-1a6f-4af4-afc3-4e2052f0610e version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf - https://attack.mitre.org/techniques/T1222/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L144 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a8568b10-9ab9-4140-a523-1c72e0176924 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 080690f079..6cd471d6f5 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -2,7 +2,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d version: 15 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://attack.mitre.org/techniques/T1218/001/ - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L191 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 20cb05e0-1fa5-406d-92c1-84da4ba01813 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index ea161433fb..a0660e5aa9 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -2,7 +2,7 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca version: 12 creation_date: '2022-12-06' -modification_date: '2026-06-25' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -41,6 +41,7 @@ references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - VIP Keylogger - Phantom Stealer asset_type: Endpoint +atomic_guid: + - 038263cb-00f4-4b0a-98ae-0696c67e1752 mitre_attack_id: - T1049 product: diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 6cdd11a4d4..42e84f9ed2 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -2,7 +2,7 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present if the vbscript syncappvpu references: - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1216.002/T1216.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 275d963d-3f36-476c-8bef-a2a3960ee6eb mitre_attack_id: - T1216 - T1218 diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 0e00d65198..2d254087fe 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -2,7 +2,7 @@ name: Windows System Time Discovery W32tm Delay id: b2cc69e7-11ba-42dc-a269-59c069a48870 version: 11 creation_date: '2022-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://cert.gov.ua/article/405538 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ intermediate_findings: analytic_story: - DarkCrystal RAT asset_type: Endpoint +atomic_guid: + - d5d5a6b0-0f92-42d8-985d-47aafa2dd4db mitre_attack_id: - T1124 product: diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 3e67a3b86f..94d79507ab 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -2,7 +2,7 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 version: 8 creation_date: '2022-12-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -33,11 +33,16 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Prestige Ransomware - Crypto Stealer - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 3e93492d9e..72ddb7df02 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -2,7 +2,7 @@ name: Windows WMI Process Call Create id: 0661c2de-93de-11ec-9833-acde48001122 version: 9 creation_date: '2022-02-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 analytic_story: - Volt Typhoon - Qakbot @@ -40,6 +41,8 @@ analytic_story: - CISA AA23-347A - Cactus Ransomware asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml index 414b2eb0dd..5170634032 100644 --- a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml +++ b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml @@ -2,7 +2,7 @@ name: Windows WMI Reconnaissance Class Query id: 5e38bd3e-5da7-483d-aa61-27f7e8c27ad1 version: 3 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -64,6 +64,9 @@ how_to_implement: | known_false_positives: Administrators may execute this command for testing or auditing. references: - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L24 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -91,6 +94,10 @@ threat_objects: analytic_story: - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - c107778c-dcf5-47c5-af2e-1d058a3df3ea + - 5750aa16-0e59-4410-8b9a-8a47ca2788e2 + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmic_shadowcopy_delete.yml b/detections/endpoint/windows_wmic_shadowcopy_delete.yml index aad14e502b..26a3b9d0b5 100644 --- a/detections/endpoint/windows_wmic_shadowcopy_delete.yml +++ b/detections/endpoint/windows_wmic_shadowcopy_delete.yml @@ -2,7 +2,7 @@ name: Windows WMIC Shadowcopy Delete id: 0a8c4b26-a4e2-4ef1-b0d9-62af6d36bdc8 version: 5 creation_date: '2025-03-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, AJ King, Splunk status: production type: Anomaly @@ -20,6 +20,7 @@ known_false_positives: Legitimate system maintenance or backup operations may oc references: - https://any.run/malware-trends/cactus - https://attack.mitre.org/techniques/T1490/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L29 drilldown_searches: - name: View the detection results for - "$dest$" and "$process_name$" search: '%original_detection_search% | search dest = "$dest$" process_name = "$process_name$"' @@ -45,6 +46,8 @@ analytic_story: - Volt Typhoon - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 6a3ff8dd-f49c-4272-a658-11c2fe58bd88 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_wmic_systeminfo_discovery.yml b/detections/endpoint/windows_wmic_systeminfo_discovery.yml index e91dc6acd9..e1c8573531 100644 --- a/detections/endpoint/windows_wmic_systeminfo_discovery.yml +++ b/detections/endpoint/windows_wmic_systeminfo_discovery.yml @@ -2,7 +2,7 @@ name: Windows Wmic Systeminfo Discovery id: 97937ece-cb13-4dbc-9684-c0dc3afd400a version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may execute this command for testing or auditing. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L381 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Endpoint +atomic_guid: + - 8851b73a-3624-4bf7-8704-aa312411565c mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 367735a71c..43eb55bf2d 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d version: 11 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -57,6 +57,9 @@ references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 intermediate_findings: entities: - field: dest @@ -69,6 +72,10 @@ threat_objects: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 605bf5d24e..14db112d4c 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 version: 13 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly @@ -35,6 +35,9 @@ references: - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -53,6 +56,10 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 2afa39f3c5..f8a291d67d 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -2,7 +2,7 @@ name: Wmic Group Discovery id: 83317b08-155b-11ec-8e00-acde48001122 version: 12 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L83 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Active Directory Discovery - LAMEHUG asset_type: Endpoint +atomic_guid: + - 7413be50-be8e-430f-ad4d-07bf197884b2 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 62ae6bd88a..c3688205fd 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ references: - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L126 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -84,6 +85,8 @@ analytic_story: - Suspicious WMI Use - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 7f5be499-33be-4129-a560-66021f379b9b mitre_attack_id: - T1220 product: diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index d37e611753..5497c015bc 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -2,7 +2,7 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 version: 13 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://attack.mitre.org/groups/G0046/ - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L92 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - FIN7 - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 1b237334-3e21-4a0c-8178-b8c996124988 mitre_attack_id: - T1220 product: From a13d5f78d9dce3d006b8706783c665536eee618b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 13 Oct 2026 12:22:57 +0200 Subject: [PATCH 35/52] Promote AI Content to Prod and Enhance it (#4287) --- .../ollama_abnormal_network_connectivity.yml | 88 +++++++++++------ .../ollama_excessive_api_requests.yml | 61 +++++++++--- ...ollama_long_running_inference_requests.yml | 97 +++++++++++++++++++ ...sible_api_endpoint_scan_reconnaissance.yml | 78 ++++++++++----- ...sible_memory_exhaustion_resource_abuse.yml | 69 ++++++++++--- .../ollama_repeated_application_errors.yml | 85 ++++++++++++++++ ...rmal_service_crash_availability_attack.yml | 14 ++- ...ssible_model_exfiltration_data_leakage.yml | 10 +- .../ollama_possible_rce_via_model_loading.yml | 13 ++- ..._suspicious_prompt_injection_jailbreak.yml | 14 ++- 10 files changed, 429 insertions(+), 100 deletions(-) create mode 100644 detections/application/ollama_long_running_inference_requests.yml create mode 100644 detections/application/ollama_repeated_application_errors.yml rename detections/{application => deprecated}/ollama_abnormal_service_crash_availability_attack.yml (90%) rename detections/{application => deprecated}/ollama_possible_model_exfiltration_data_leakage.yml (92%) rename detections/{application => deprecated}/ollama_possible_rce_via_model_loading.yml (92%) rename detections/{application => deprecated}/ollama_suspicious_prompt_injection_jailbreak.yml (90%) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c12fe51364..2a48c92012 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -1,54 +1,79 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. +description: |- + Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance. data_source: - Ollama Server search: |- - `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*") - | eval src=coalesce(src, src_ip, "N/A") - | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident - BY host - | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") - | eval severity="medium" - | eval attack_type="Abnormal Network Connectivity" - | stats count - BY last_incident, host, incidents, - src, warning_messages, severity, - attack_type - | `ollama_abnormal_network_connectivity_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. + `ollama_server` + level=WARN + msg IN ( + "*connection*", + "*dial tcp*", + "*failed*", + "*lookup*", + "*network*", + "*no such host*", + "*refused*", + "*timeout*", + "*unreachable*" + ) + + | bin _time span=5m + | stats count as incidents + values(msg) as warning_messages + latest(_time) as last_incident + by _time dest + + | where incidents > 3 + + | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") + + | eval severity="medium" + + | eval attack_type="Abnormal Network Connectivity" + + | table last_incident dest incidents warning_messages severity attack_type + + | `ollama_abnormal_network_connectivity_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + - name: View the detection results for - "$dest$" + search: |- + %original_detection_search% + | search dest="$dest$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$",) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$dest$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: entities: - - field: host + - field: dest type: system score: 20 - message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.' -threat_objects: - - field: src - type: system + message: Abnormal network activity on [$dest$] with [$incidents$] matching warnings [$warning_messages$]. Investigate DNS and network reachability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application -mitre_attack_id: - - T1571 +mitre_attack_id: [] product: - Splunk Enterprise - Splunk Enterprise Security @@ -61,5 +86,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 42f4958876..76eb6313a1 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -1,26 +1,62 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. +description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) + + | bin _time span=5m + + | stats count as request_count + dc(uri_path) as distinct_endpoints + values(uri_path) as endpoints + by _time src + + | where request_count > 120 + + | eval severity="medium" + + | eval attack_type="High Volume API Activity" + + | `ollama_excessive_api_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +64,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability. + message: '[$request_count$] Ollama API requests from [$src$] across [$distinct_endpoints$] endpoints were observed in 5 minutes. Validate the client and workload before attributing the burst to abuse or service impact.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +82,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml new file mode 100644 index 0000000000..49661c873e --- /dev/null +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -0,0 +1,97 @@ +name: Ollama Long-Running Inference Requests +id: 7619c98c-f53b-445f-87ca-b148e8560340 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-10' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. + Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal. +data_source: + - Ollama Server +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?(?:\d+h)?(?:\d+m)?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=mvindex(split(coalesce(uri_path, raw_path), "?"), 0) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | rex field=raw_latency "^(?:(?\d+)h)?(?:(?\d+)m)?(?[\d\.]+)(?µs|ms|s)$" + | eval response_time_ms=(coalesce(tonumber(raw_latency_hours), 0) * 3600000) + (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000)) + + | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000 + + | eval response_time_seconds=response_time_ms/1000 + + | bin _time span=10m + + | stats count as long_request_count + avg(response_time_seconds) as avg_response_time + max(response_time_seconds) as max_response_time + values(uri_path) as uri_path + values(http_response_code) as status_codes + by _time src host + + | where long_request_count > 1 + + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(max_response_time > 55, "high", 1=1, "medium") + | eval attack_type="Long-Running Inference Requests" + + | table _time host src uri_path long_request_count + avg_response_time max_response_time + status_codes severity attack_type + + | `ollama_long_running_inference_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. +references: + - https://github.com/rosplk/ta-ollama + - https://github.com/OWASP/www-project-ai-testing-guide +drilldown_searches: + - name: View the detection results for - "$src$" + search: |- + %original_detection_search% + | search src="$src$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: '[$long_request_count$] long-running inference requests from [$src$] averaged [$avg_response_time$] seconds and reached [$max_response_time$] seconds. Investigate workload, model size, prompt length, and host capacity; access logs do not establish prompt injection or data exfiltration.' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log + sourcetype: ollama:server + source: server.log + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index aa1b54cd73..524253871e 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -1,38 +1,69 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. +description: |- + Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: - Ollama Server search: |- - `ollama_server` "[GIN]" - | bin _time span=5m - | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes - BY _time, src, host - | where total_requests > 120 - | eval severity="medium" - | eval attack_type="API Activity Surge" - | stats count - BY _time, host, src, - total_requests, dest, methods, - status_codes, severity, attack_type - | `ollama_possible_api_endpoint_scan_reconnaissance_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND isnotnull(uri_path) + + | bin _time span=5m + + | stats count as total_requests + dc(uri_path) as distinct_endpoints + count(eval(http_method="HEAD")) as head_requests + values(uri_path) as endpoints + values(http_method) as methods + values(http_response_code) as status_codes + by _time src host + + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) + + | eval severity="medium" + | eval attack_type="API Activity Surge" + + | table _time host src total_requests + distinct_endpoints endpoints methods + status_codes severity attack_type + + | `ollama_possible_api_endpoint_scan_reconnaissance_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -40,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: API reconnaissance activity detected from $src$ on $host$ with $total_requests$ requests across different endpoints using methods $methods$ and receiving status codes $status_codes$, indicating systematic endpoint enumeration to map API attack surface and identify potential vulnerabilities. + message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -58,5 +89,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 6b9e2b38cb..a124408fcb 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -1,26 +1,70 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. +description: |- + Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. +search: |- + `ollama_server` + ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") + + | rex field=_raw "count=(?\d+)" + | rex field=_raw "(?[\d\.]+)\s+MiB" + | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" + | rex field=_raw "source=(?[^\s]+)" + + | bin _time span=5m + + | stats count as operations + avg(load_time) as avg_load_time + avg(memory_mb) as avg_memory + dc(code_source) as unique_sources + max(load_time) as max_load_time + max(memory_mb) as max_memory + max(runner_count) as peak_loaded_runners + values(code_source) as code_sources + by _time host + + | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400 + + | eval avg_memory=round(avg_memory, 2) + | eval max_memory=round(max_memory, 2) + | eval avg_load_time=round(avg_load_time, 2) + | eval max_load_time=round(max_load_time, 2) + | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low") + | eval attack_type="Resource Pressure / Memory Allocation" + + | table _time host operations peak_loaded_runners + unique_sources avg_memory max_memory + avg_load_time max_load_time severity attack_type + + | `ollama_possible_memory_exhaustion_resource_abuse_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$host$" - search: '%original_detection_search% | search "$host = "$host$"' + search: |- + %original_detection_search% + | search host="$host$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +72,7 @@ intermediate_findings: - field: host type: system score: 20 - message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse. + message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +90,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml new file mode 100644 index 0000000000..0dd0538dec --- /dev/null +++ b/detections/application/ollama_repeated_application_errors.yml @@ -0,0 +1,85 @@ +name: Ollama Repeated Application Errors +id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry. +data_source: + - Ollama Server +search: |- + `ollama_server` + (level=ERROR OR level=FATAL) + + | rex field=_raw "msg=\"(?[^\"]+)\"" + | rex field=_raw "exit_code=(?\d+)" + + | bin _time span=5m + + | stats count as error_count + earliest(_time) as first_seen + latest(_time) as last_seen + values(msg) as error_messages + values(exit_code) as exit_codes + dc(msg) as unique_errors + by _time host + + | where error_count > 1 + + | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") + | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") + | eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium") + | eval attack_type="Repeated Ollama Application Errors" + + | table first_seen last_seen host error_count + unique_errors error_messages severity attack_type + + | `ollama_repeated_application_errors_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage. +references: + - https://github.com/rosplk/ta-ollama +drilldown_searches: + - name: View the detection results for - "$host$" + search: |- + %original_detection_search% + | search host="$host$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: 'Repeated Ollama application errors detected on host [$host$] between [$first_seen$] and [$last_seen$]: [$error_count$] events and [$unique_errors$] unique error types. Correlate with service manager logs to determine whether availability was affected. Error messages: [$error_messages$].' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log + sourcetype: ollama:server + source: app.log + test_type: unit diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml similarity index 90% rename from detections/application/ollama_abnormal_service_crash_availability_attack.yml rename to detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e37ebbe1b6..9c14555e32 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -46,5 +46,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Repeated Application Errors diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml similarity index 92% rename from detections/application/ollama_possible_model_exfiltration_data_leakage.yml rename to detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index 3140267adc..f04b73cb26 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -1,10 +1,10 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: @@ -48,3 +48,7 @@ tests: source: server.log test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml similarity index 92% rename from detections/application/ollama_possible_rce_via_model_loading.yml rename to detections/deprecated/ollama_possible_rce_via_model_loading.yml index be366b8ce8..8fdeddd5ee 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -1,10 +1,10 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -46,5 +46,8 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml similarity index 90% rename from detections/application/ollama_suspicious_prompt_injection_jailbreak.yml rename to detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index 3fdfeb434f..691b8187d5 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -1,10 +1,10 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: @@ -48,5 +48,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Long-Running Inference Requests From a3936a06504da4766ee58d3cb7cd5cc6f331cdad Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Tue, 13 Oct 2026 06:24:38 -0500 Subject: [PATCH 36/52] PingID credential-reset correlation: normalize usernames and handle multiple resets (#4298) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- ..._new_mfa_method_after_credential_reset.yml | 64 +++++++++++++++++-- 1 file changed, 57 insertions(+), 7 deletions(-) diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 534ffc8cb2..7b0097d43c 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -1,17 +1,57 @@ name: PingID New MFA Method After Credential Reset id: 2fcbce12-cffa-4c84-b70c-192604d201d0 -version: 9 +version: 10 creation_date: '2023-12-20' -modification_date: '2026-05-13' +modification_date: '2026-09-29' author: Steven Dick status: production type: TTP -description: The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. +description: |- + The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes + (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user + to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. data_source: - PingID -search: "`pingid` \"result.message\" = \"*Device Paired*\" | rex field=result.message \"Device (Unp)?(P)?aired (?.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time = _time, user = upper(user) | fields user,src_user,EventID,PW_Change_Time] | eval timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,\"duration\"),\"(\\d*)\\+*(\\d+):(\\d+):(\\d+)\",\"\\2 hours \\3 minutes\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`" -how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. -known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. +search: | + `pingid` + "result.message" = "*Device Paired*" + + | rex field=result.message "Device (Unp)?(P)?aired (?.+)" + | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel') + + | eval user = upper('actors{}.name') + | eval reason = 'result.message' + | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) + | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', "Device Unpaired*"),"deleted") + + | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object + + ```Standardizes user field by removing NetBIOS and email from reported user name``` + + | eval join_user = replace(user, "^[^\x5c]*\x5c|@.*$", "") + | join type=outer max=0 join_user [ + | search `wineventlog_security` EventID IN(4723,4724) + | eval PW_Change_Time = _time + ```Standardizes user field by removing NetBIOS and email from reported user name``` + | eval join_user = replace(upper(user), "^[^\x5c]*\x5c|@.*$", "") + | fields join_user,src_user,EventID,PW_Change_Time + ] + + | eval timeDiffRaw = round(lastTime - PW_Change_Time) + | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(PW_Change_Time)` + + | where timeDiffRaw > 0 AND timeDiffRaw < 3600 + | dedup src, user, action, object, lastTime sortby +timeDiffRaw + | fields - join_user + + | `pingid_new_mfa_method_after_credential_reset_filter` +how_to_implement: |- + Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. +known_false_positives: |- + False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. references: - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677 - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/ @@ -28,11 +68,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was $action$. + title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was [$action$]. entity: field: user type: user score: 50 +threat_objects: [] analytic_story: - Compromised User Account - Scattered Lapsus$ Hunters @@ -57,3 +98,12 @@ tests: source: PINGID sourcetype: _json test_type: unit + - name: True Positive Test - UPN usernames and multiple resets + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log + source: PINGID + sourcetype: _json + test_type: unit From 7e9ead05a777ed79dfa56c49a9fd223aba6d5509 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:01:06 -0400 Subject: [PATCH 37/52] New Zeek Based Detections Migrated from SnapAttack(#4337) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/zeek_http.yml | 36 ++++++ data_sources/zeek_ssh.yml | 30 +++++ ...http_post_request_with_encoded_payload.yml | 89 +++++++++++++++ .../network/unusual_ssh_client_banner.yml | 102 +++++++++++++++++ .../web/unusual_http_request_method.yml | 104 ++++++++++++++++++ macros/zeek_http.yml | 8 ++ macros/zeek_ssh.yml | 8 ++ 7 files changed, 377 insertions(+) create mode 100644 data_sources/zeek_http.yml create mode 100644 data_sources/zeek_ssh.yml create mode 100644 detections/network/http_post_request_with_encoded_payload.yml create mode 100644 detections/network/unusual_ssh_client_banner.yml create mode 100644 detections/web/unusual_http_request_method.yml create mode 100644 macros/zeek_http.yml create mode 100644 macros/zeek_ssh.yml diff --git a/data_sources/zeek_http.yml b/data_sources/zeek_http.yml new file mode 100644 index 0000000000..23fb4433df --- /dev/null +++ b/data_sources/zeek_http.yml @@ -0,0 +1,36 @@ +name: Zeek HTTP +id: 257a3ae6-a3f6-44e0-9d10-bdc5b4f011a3 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs HTTP requests and responses analyzed by Zeek, including methods, URI, host, status codes, and request bodies when configured. +mitre_components: + - Network Traffic Content + - Network Traffic Flow + - Application Log Content +source: http.log +sourcetype: zeek:http +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - method + - uri + - host + - status_code + - post_body + - user_agent +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - uri + - method + - status_code +example_log: '{"ts": 1665164348.511363, "uid": "Ct9dph2EXJhTjowDF3", "id.orig_h": "192.168.196.131", "id.orig_p": 50050, "id.resp_h": "192.168.196.129", "id.resp_p": 80, "trans_depth": 13, "method": "POST", "host": "192.168.196.129", "uri": "/test.php", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "request_body_len": 108, "response_body_len": 0, "status_code": 200, "status_msg": "OK", "tags": [], "orig_fuids": ["FwroIQ2TSmbiOBzVz4"], "orig_mime_types": ["text/plain"], "post_body": "hMUlHTVEzmc+5fNbbspSRUEVsphYbAJ2Sy3CJZ9K12xyL1cRo1jrslMNWGGNnxbHB14R/CMybW0Z2+wOIuWtkDfKUG2IMpcOUutkDFdSiKo=", "client_header_names": ["USER-AGENT", "HOST", "CONTENT-LENGTH", "CACHE-CONTROL"], "client_header_values": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "192.168.196.129", "108", "no-cache"], "server_header_names": ["CONTENT-TYPE", "DATE", "CONTENT-LENGTH"], "server_header_values": ["text/html", "Fri, 07 Oct 2022 17:39:09 GMT", "0"], "row_id": "dd80e4d5-b10b-4de0-bcd8-dba62c2901ea", "snapattack_session": "e50dc64e-0fc6-b1ad-429c-23ccdd5452c4"}' diff --git a/data_sources/zeek_ssh.yml b/data_sources/zeek_ssh.yml new file mode 100644 index 0000000000..4e165c3137 --- /dev/null +++ b/data_sources/zeek_ssh.yml @@ -0,0 +1,30 @@ +name: Zeek SSH +id: 9e228bf6-8c75-4d36-997c-e5ef1e1bf760 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs SSH handshakes analyzed by Zeek, including client and server banners and connection endpoints. +mitre_components: + - Network Traffic Content + - Network Traffic Flow +source: ssh.log +sourcetype: zeek:ssh +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - client + - server + - uid +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - client +example_log: '{"_path":"ssh","_write_ts":"2026-01-15T09:21:33.456789Z","ts":"2026-01-15T09:21:32.987654Z","uid":"CkLmNo2Yp3qrStUv56","id.orig_h":"192.168.20.75","id.orig_p":53874,"id.resp_h":"198.51.100.20","id.resp_p":2222,"version":2,"auth_success":true,"auth_attempts":1,"direction":"OUTBOUND","client":"SSH-2.0-SecureBlackbox","server":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","cipher_alg":"aes256-ctr","mac_alg":"hmac-sha1","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha256","host_key_alg":"ssh-ed25519","host_key":"11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00","remote_location.country_code":"US","remote_location.region":"MD","remote_location.city":"Baltimore","remote_location.latitude":39.2904,"remote_location.longitude":-76.6122}' diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml new file mode 100644 index 0000000000..f05fb1a082 --- /dev/null +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -0,0 +1,89 @@ +name: HTTP POST Request with Encoded Payload +id: 0590881d-7b81-48dd-9674-1f23f7db5d40 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method="POST" + post_body="*" + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) + | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + + | where _hex=1 OR _b64=1 + + | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(encoding_type) as encoding_type + values(post_body) as post_body + + by src dest dest_port uri method status_code + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `http_post_request_with_encoded_payload_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content. + Review the destination, URI, and post body content to confirm whether the activity is expected. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1132/001/ + - https://docs.zeek.org/en/master/logs/http.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - Data Exfiltration +asset_type: Network +mitre_attack_id: + - T1071.001 + - T1132.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/detections/network/unusual_ssh_client_banner.yml b/detections/network/unusual_ssh_client_banner.yml new file mode 100644 index 0000000000..5bd366d59e --- /dev/null +++ b/detections/network/unusual_ssh_client_banner.yml @@ -0,0 +1,102 @@ +name: Unusual SSH Client Banner +id: 93d0f598-d65f-4c97-b030-5bb0af51a226 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. + Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement. +data_source: + - Zeek SSH +search: |- + `zeek_ssh` + client="*" + NOT client IN ( + "SSH-2.0-AsyncSSH*", + "SSH-2.0-Bitvise*", + "SSH-2.0-Cisco*", + "SSH-2.0-CyberArk*", + "SSH-2.0-dropbear*", + "SSH-2.0-FileZilla*", + "SSH-2.0-Go*", + "SSH-2.0-JSCH*", + "SSH-2.0-Juniper*", + "SSH-2.0-libssh*", + "SSH-2.0-MobaXterm*", + "SSH-2.0-OpenSSH*", + "SSH-2.0-paramiko*", + "SSH-2.0-PuTTY*", + "SSH-2.0-Renci.SshNet*", + "SSH-2.0-SecureCRT*", + "SSH-2.0-ssh2*", + "SSH-2.0-TTSSH*", + "SSH-2.0-WinSCP*", + "SSH-2.0-Xshell*" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | fillnull value=NULL + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(client) as client + values(post_body) as post_body + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_ssh_client_banner_filter` +how_to_implement: |- + Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The client field should be populated from the SSH handshake banner. + Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate but uncommon SSH client software not included will generate false positives. + Review the client banner and tune the filter accordingly. +references: + - https://docs.zeek.org/en/master/logs/ssh.html + - https://attack.mitre.org/techniques/T1021/004/ + - https://attack.mitre.org/techniques/T1572/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$]. +threat_objects: [] +analytic_story: + - Ingress Tool Transfer + - Command And Control +asset_type: Network +mitre_attack_id: + - T1021.004 + - T1572 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log + sourcetype: zeek:ssh + source: ssh.log + test_type: unit diff --git a/detections/web/unusual_http_request_method.yml b/detections/web/unusual_http_request_method.yml new file mode 100644 index 0000000000..de65394066 --- /dev/null +++ b/detections/web/unusual_http_request_method.yml @@ -0,0 +1,104 @@ +name: Unusual HTTP Request Method +id: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. + Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. + Review the method, source, destination, and URI to assess the activity. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method=* + NOT method IN ( + "ACL", + "CCM_POST", + "CONNECT", + "COPY", + "DELETE", + "GET", + "HEAD", + "LOCK", + "MKCOL", + "MOVE", + "OPTIONS", + "PATCH", + "POST", + "PRI", + "PROPFIND", + "PROPPATCH", + "PUT", + "REPORT", + "SEARCH", + "TRACE", + "unknown", + "UNLOCK" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | stats count min(_time) as firstTime max(_time) as lastTime + values(method) as method + values(uri) as uri + values(status_code) as status_code + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_http_request_method_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Some legitimate applications and frameworks may use non-standard HTTP methods. + Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1190/ + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - HTTP Request Smuggling +asset_type: Web Server +mitre_attack_id: + - T1071.001 + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: web +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/macros/zeek_http.yml b/macros/zeek_http.yml new file mode 100644 index 0000000000..f2428481ee --- /dev/null +++ b/macros/zeek_http.yml @@ -0,0 +1,8 @@ +name: zeek_http +id: 5deefc82-d7b0-4c6a-a9e3-fce5ebbd4291 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek HTTP logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:http" diff --git a/macros/zeek_ssh.yml b/macros/zeek_ssh.yml new file mode 100644 index 0000000000..090cc48ace --- /dev/null +++ b/macros/zeek_ssh.yml @@ -0,0 +1,8 @@ +name: zeek_ssh +id: 915ebcdf-ef44-4815-936a-901ee7dde6dc +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek SSH logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:ssh" From 6e6fe3b033317c6ba8a7c7e2317a73e734f70739 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Oct 2026 10:12:01 -0700 Subject: [PATCH 38/52] Deprecated `Detect Large ICMP Traffic` Based On .conf Telemetry (#4313) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_large_icmp_traffic.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) rename detections/{network => deprecated}/detect_large_icmp_traffic.yml (95%) diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml similarity index 95% rename from detections/network/detect_large_icmp_traffic.yml rename to detections/deprecated/detect_large_icmp_traffic.yml index 98f14307a8..f491f9d89e 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -1,10 +1,10 @@ name: Detect Large ICMP Traffic id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8 -version: 8 +version: 9 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: production +status: deprecated type: TTP description: | The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. @@ -95,3 +95,7 @@ tests: source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:firewall test_type: unit +deprecation_info: + reason: Detection deprecated as it is determined to be very noisy in a production environment. + removed_in_version: 6.12.0 + replacement_content: [] From 19be274d85e51352b746f703db748cd948887340 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 22:36:44 +0200 Subject: [PATCH 39/52] Automated NIST AI RMF lookup table update (#4340) --------- Co-authored-by: Nasreddine Bencherchali --- lookups/csv/detection_subcategory_map.csv | 14 ++++++-------- lookups/csv/detection_subcategory_map.yml | 2 +- .../generate_nist_ai_rmf_detection_map.py | 17 +++++++++++++++++ 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 5a4b938343..25cf98922b 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -23,11 +23,9 @@ MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal -Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Excessive API Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Long-Running Inference Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.4,high,generated_rule,Production AI functionality and behavior monitoring signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Repeated Application Errors,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.3,high,generated_rule,Production behavior monitoring and incident/error tracking signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index 01c7b156b9..dbf0a875df 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -2,7 +2,7 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 version: 3 creation_date: '2026-09-02' -modification_date: '2026-10-08' +modification_date: '2026-10-13' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py index 9b651f28e6..7cf35488c1 100644 --- a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -81,6 +81,16 @@ class MappingRule: ("Measure 2.4",), "Production behavior monitoring signal", ), + MappingRule( + re.compile(r"\blong[- ]running inference requests?\b", re.I), + ("Measure 2.4",), + "Production AI functionality and behavior monitoring signal", + ), + MappingRule( + re.compile(r"\brepeated (?:ollama )?application errors?\b", re.I), + ("Measure 2.4", "Manage 4.3"), + "Production behavior monitoring and incident/error tracking signal", + ), MappingRule( re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), ("Measure 2.6",), @@ -383,6 +393,13 @@ def main() -> int: output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + review_rows = [row for row in rows if row["mapping_source"] == "generated_review"] + if review_rows: + message += f" {len(review_rows)} mapping(s) need manual review:" + for row in review_rows: + message += f"\n - {row['ai_system']}: {row['detection_name']} — {row['mapping_reason']}" + else: + message += " No mappings need manual review." if not args.dry_run: if output_changed and not args.no_metadata_update: new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) From 13bf1750b21768c03a2237ecfd27b54644bc6de9 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Wed, 14 Oct 2026 02:12:41 +0200 Subject: [PATCH 40/52] Updating Set of Nirsoft Detections (#4303) --------- Co-authored-by: Nasreddine Bencherchali --- .../detection_of_tools_built_by_nirsoft.yml | 11 +- .../possible_browser_pass_view_parameter.yml | 11 +- .../windows_nirsoft_advancedrun.yml | 9 +- ...ndows_nirsoft_tool_bundle_file_created.yml | 40 +- .../endpoint/windows_nirsoft_utilities.yml | 53 +- lookups/csv/nirsoft_utilities_lookup.csv | 592 ++++++++++++++++++ lookups/csv/nirsoft_utilities_lookup.yml | 12 + 7 files changed, 688 insertions(+), 40 deletions(-) rename detections/{endpoint => deprecated}/detection_of_tools_built_by_nirsoft.yml (92%) rename detections/{endpoint => deprecated}/possible_browser_pass_view_parameter.yml (92%) rename detections/{endpoint => deprecated}/windows_nirsoft_advancedrun.yml (95%) create mode 100644 lookups/csv/nirsoft_utilities_lookup.csv create mode 100644 lookups/csv/nirsoft_utilities_lookup.yml diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 92% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605..2fe7690cc0 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 92% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a..b21bcb9a31 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 95% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index b91a5c4c4c..8e8fc5ffdf 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -85,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b4..7e4a09118f 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,14 +1,13 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. @@ -20,23 +19,17 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name = "*.zip" + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +64,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction @@ -88,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index eb146d19cc..5d5dd6628d 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,47 +1,78 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint atomic_guid: - 81ce22fd-9612-4154-918e-8a1f285d214d diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 0000000000..ba62fd11e7 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,592 @@ +original_file_name,description +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." +addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." +axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." +cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." +devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." +dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." +downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." +folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" +gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." +jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" +mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." +netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." +serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." +shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." +shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." +strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." +whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " +winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." +zipinst.zip,"ZIP Bundle for zipinst.exe" diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 0000000000..ebd1525ea4 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false From adc69d950e1fe19393d418269ed7881c95a98104 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:19:57 -0700 Subject: [PATCH 41/52] Fix Failing Integration Tests (#4338) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/sysmon_eventid_15.yml | 72 ++++++++++--------- data_sources/sysmon_eventid_22.yml | 65 ++++++++--------- ..._aws_ecr_container_upload_unknown_user.yml | 50 +++++++++---- ...iles_filter_loaded_by_uncommon_process.yml | 40 ++++++----- ...tem_process_querying_definition_update.yml | 34 ++++++--- ...rmgr_alternate_data_stream_in_temp_dir.yml | 11 +-- 6 files changed, 157 insertions(+), 115 deletions(-) diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea7..26bc8419fa 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -22,43 +22,11 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - Contents - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hash - - IMPHASH - - Image - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -70,33 +38,66 @@ fields: - dest - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_hash - file_name - file_path + - Guid + - Hash - host - id + - Image + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -110,6 +111,7 @@ output_fields: - process_path - signature - signature_id + - user - user_id - vendor_product example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c146..2a53a74962 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -24,36 +24,6 @@ fields: - _time - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - QueryName - - QueryResults - - QueryStatus - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - date_hour - date_mday - date_minute @@ -64,30 +34,61 @@ fields: - date_zone - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_name + - ProcessGuid + - ProcessId + - ProcessID - punct - query - query_count + - QueryName + - QueryResults + - QueryStatus + - record_type + - RecordID + - RecordNumber - reply_code_id + - RuleName + - SecurityID - signature - signature_id - source - sourcetype - splunk_server - src + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - answer - answer_count diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 404144c034..6831869df1 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -1,27 +1,47 @@ name: ASL AWS ECR Container Upload Unknown User id: 886a8f46-d7e2-4439-b9ba-aec238e31732 -version: 12 +version: 13 creation_date: '2024-05-22' modification_date: '2026-05-13' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment. +description: |- + The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. + It identifies instances where a new container is uploaded by a user not previously recognized as authorized. data_source: - ASL AWS CloudTrail search: |- - `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY actor.user.uid api.operation api.service.name - http_request.user_agent src_endpoint.ip actor.user.account.uid - cloud.provider cloud.region - | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `asl_aws_ecr_container_upload_unknown_user_filter` -how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. -known_false_positives: No false positives have been identified at this time. + `amazon_security_lake` + api.operation=PutImage + NOT `aws_ecr_users_asl` + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by actor.user.uid api.operation api.service.name + http_request.user_agent + src_endpoint.ip actor.user.account.uid + cloud.provider cloud.region + + | rename actor.user.account.uid as vendor_account + actor.user.uid as user + api.operation as action + api.service.name as dest + cloud.provider as vendor_product + cloud.region as vendor_region + http_request.user_agent as user_agent + src_endpoint.ip as src + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `asl_aws_ecr_container_upload_unknown_user_filter` +how_to_implement: |- + The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1204/003/ drilldown_searches: @@ -38,7 +58,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Container uploaded from unknown user $user$ + message: Container uploaded from unknown user [$user$]. threat_objects: - field: src type: ip_address diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index f15a399546..8e6bd9a38d 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -1,13 +1,13 @@ name: Windows Cloud Files Filter Loaded by Uncommon Process id: 77b85062-274e-43a5-9dab-c25862b85291 -version: 1 +version: 2 creation_date: '2026-05-18' -modification_date: '2026-05-18' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. data_source: - Sysmon EventID 7 @@ -16,22 +16,25 @@ search: |- EventID=7 ImageLoaded="*\\cldapi.dll" NOT Image IN ( - "*\\box.exe", - "*\\dropbox.exe", - "*\\googledrivefs.exe", - "*\\icloud.exe", - "*\\onedrive*.exe", - "*\\Windows\\explorer.exe" - "*\\Windows\\System32\\*", - "*\\Windows\\Syswow64\\*", - "*\\Windows\\WinSxS\\*" + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "C:\\Windows\\explorer.exe", + "C:\\Windows\\System32\\*", + "C:\\Windows\\Syswow64\\*", + "C:\\Windows\\WinSxS\\*" ) + | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec - process_guid process_hash process_id process_name process_path - service_dll_signature_exists service_dll_signature_verified signature_id user_id - vendor_product + + by dest loaded_file_path loaded_file + process_path process_name process_exec process_guid process_hash process_id + service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` @@ -57,7 +60,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ + message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: loaded_file_path + type: loaded_file analytic_story: - RedSun - BlueHammer diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index f2a81e0116..b428d437a8 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -1,13 +1,14 @@ name: Windows Non-System Process Querying Definition Update id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. + BlueHammer utilizes these definition updates as part of its exploit chain. data_source: - Sysmon EventID 22 search: |- @@ -15,16 +16,27 @@ search: |- EventID="22" QueryName="*definitionupdates.microsoft.com*" NOT Image IN ( - "*:\\Program Files\\Microsoft Office\\*", - "*:\\Program Files\\Windows Defender\\*", - "*:\\ProgramData\\Microsoft\\Windows Defender\\*", - "*:\\Windows\\System32\\*", - "*:\\Windows\\SysWOW64\\*" + "C:\\Program Files\\Microsoft Office\\*", + "C:\\Program Files\\Windows Defender\\*", + "C:\\ProgramData\\Microsoft\\Windows Defender\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + + | rename Computer as dest, + Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by src dest answer answer_count + process_path process_name process_exec process_guid + query query_count QueryResults record_type reply_code_id + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -46,7 +58,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. + message: Non-System process [$process_path$] queried Windows Defender Definition Updates domain [$query$] on [$dest$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index 54fd1c50a9..7f894ff9bf 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 2 +version: 3 creation_date: '2026-06-11' -modification_date: '2026-09-08' +modification_date: '2026-10-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -20,9 +20,10 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime - by dest dvc file_hash file_name file_path process_exec - process_guid process_id process_name process_path - signature signature_id user_id vendor_product Contents Image + by dest file_hash file_name file_path + process_path process_name process_exec process_guid process_id + user_id user Contents + signature signature_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From a268aeebf542016206d23b27d6e2964f6dda3500 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 15 Oct 2026 04:18:14 -0700 Subject: [PATCH 42/52] Update data source TA and install.yml app versions (#4344) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/osquery_results.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c45..6b84113316 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -16,7 +16,7 @@ sourcetype: osquery:results supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 - version: 1.0.4 + version: 1.0.5 fields: - _time - calendarTime From 12b9d52ff37bd5bf78080de731b5798c83e858ca Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 16 Oct 2026 02:34:35 -0700 Subject: [PATCH 43/52] Update data source TA and install.yml app versions (#4347) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/splunk_stream_http.yml | 2 +- data_sources/splunk_stream_ip.yml | 2 +- data_sources/splunk_stream_tcp.yml | 2 +- install.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29522a4daa..d7d7f55286 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -16,7 +16,7 @@ sourcetype: stream:http supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index a5ffb18d05..1fbea55486 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -16,7 +16,7 @@ sourcetype: stream:ip supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index a15f404188..710bb9cb0b 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -16,4 +16,4 @@ sourcetype: stream:tcp supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 diff --git a/install.yml b/install.yml index 28ef2c7679..cb3196171a 100644 --- a/install.yml +++ b/install.yml @@ -12,10 +12,10 @@ apps: version: 2.3.4 - appid: Splunk_TA_stream url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 + version: 8.1.7 - appid: Splunk_TA_stream_wire_data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 - appid: TA-Zscaler_CIM url: https://splunkbase.splunk.com/app/3865 version: 4.1.5 From d6afc62b750dc2ed34e3696999bf26fe476b9b1e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 16 Oct 2026 15:12:12 +0200 Subject: [PATCH 44/52] Expand AI Defense Coverage (#4345) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- data_sources/cisco_ai_defense_alerts.yml | 65 ++++++++- ...co_ai_defense_allowed_sensitive_prompt.yml | 96 +++++++++++++ ..._ai_defense_allowed_sensitive_response.yml | 73 ++++++++++ ...ai_defense_repeated_high_risk_activity.yml | 96 +++++++++++++ ...se_security_alerts_by_application_name.yml | 133 +++++++++++++----- ...buse_of_genai_systems_and_applications.yml | 23 +++ 6 files changed, 447 insertions(+), 39 deletions(-) create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_response.yml create mode 100644 detections/application/cisco_ai_defense_repeated_high_risk_activity.yml create mode 100644 stories/abuse_of_genai_systems_and_applications.yml diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 2eba8da408..60efe8e519 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -1,11 +1,11 @@ name: Cisco AI Defense Alerts id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e -version: 2 +version: 3 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk description: Data source object for Cisco AI Defense Alerts -source: cisco_ai_defense +source: not_applicable sourcetype: cisco:ai:defense separator: supported_TA: @@ -13,3 +13,60 @@ supported_TA: url: https://splunkbase.splunk.com/app/7404 version: 4.1.2 fields: + - _time + - host + - app + - application_id + - connection_id + - connection.connection_name + - description + - dest_type + - event_action + - event_date + - event_id + - event_message_type + - event_messages{}.event_conversation.event_messages{}.content + - event_messages{}.event_conversation.event_messages{}.direction + - event_messages{}.event_conversation.event_messages{}.event_conversation_id + - event_messages{}.event_conversation.event_messages{}.event_ext_message_id + - event_messages{}.event_conversation.event_messages{}.event_ins_date + - event_messages{}.event_conversation.event_messages{}.event_message_id + - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs + - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id + - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{} + - event_messages{}.event_conversation.event_messages{}.related_event_message_id + - event_messages{}.event_conversation.event_messages{}.tenant_id + - event_messages{}.event_ext_message_id + - event_messages{}.event_message_id + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id + - eventtype + - genai_application.application_name + - genai_application.connection_type + - hec_event_type + - id + - index + - linecount + - model.model_name + - model.model_provider_name + - Number + - policy_id + - policy.policy_name + - punct + - resource_type + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_type + - tag + - tag::eventtype + - type + - user_id + - vendor_product +example_log: | + {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]} diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml new file mode 100644 index 0000000000..79100e68a4 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Allowed Sensitive Prompt +id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="prompt" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + + policy_name='policy.policy_name', + + event_time=_time + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + values(policy_name) as policy_names + values(application_name) as application_names + values(connection_name) as connection_names + by _time application_key connection_key + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_names connection_key connection_names + distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names + + | `cisco_ai_defense_allowed_sensitive_prompt_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings. +known_false_positives: |- + Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails. + Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation. +drilldown_searches: + - name: View the detection results for - "$application_names$" + search: '%original_detection_search% | search application_names="$application_names$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml new file mode 100644 index 0000000000..4c823a71c6 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml @@ -0,0 +1,73 @@ +name: Cisco AI Defense Allowed Sensitive Response +id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="response" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + policy_name='policy.policy_name' + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | table _time event_date event_id event_message_type event_action resource_type + application_id application_name connection_id connection_name model.model_name + policy_name guardrail_ruleset_type guardrail_entity_name + + | `cisco_ai_defense_allowed_sensitive_response_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails. + Review the application owner, policy, response context, and whether the data was expected to be disclosed. +drilldown_searches: + - name: View the detection results for - "$application_name$" + search: '%original_detection_search% | search application_name="$application_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$]. + entity: + field: application_name + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml new file mode 100644 index 0000000000..d267fb97c7 --- /dev/null +++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Repeated High Risk Activity +id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. + Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. + These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + + ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt``` + + | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0) + | where is_allowed_sensitive_prompt=0 + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name) + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs``` + | eventstats count as same_event_id_count by _time application_key connection_key event_id + + | stats count as event_count + dc(event_id) as distinct_event_count + max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count + values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids + count(eval(lower(event_action)="allow")) as allowed_event_count + count(eval(lower(event_action)="block")) as blocked_event_count + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(policy.policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(connection_name) as connection_names + values(application_name) as application_names + by _time application_key connection_key + + | where distinct_event_count>=5 OR max_same_event_id_count>=3 + + | table _time application_key application_names connection_key connection_names + event_count distinct_event_count max_same_event_id_count repeated_event_ids + allowed_event_count blocked_event_count event_actions message_types policy_names + guardrail_ruleset_types event_ids + + | `cisco_ai_defense_repeated_high_risk_activity_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed. +known_false_positives: |- + Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events. + Review whether the window contains allowed events and whether the activity was expected for the application and connection. +drilldown_searches: + - name: View the detection results for - "$application_key$" + search: '%original_detection_search% | search application_key="$application_key$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index cf1d7ef9e3..9aba8ccc19 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -1,45 +1,106 @@ name: Cisco AI Defense Security Alerts by Application Name id: 105e4a69-ec55-49fc-be1f-902467435ea8 -version: 7 +version: 8 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity. +description: |- + This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. + Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. + Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. + Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection. data_source: - Cisco AI Defense Alerts search: |- `cisco_ai_defense` - | rename genai_application.application_name as application_name - | rename connection.connection_name as connection_name - ```Aggregating data by model name, connection name, application name, application ID, and user ID``` - | stats count - values(user_id) as user_id - values(event_message_type) as event_message_type - values(event_action) as event_action - values(policy.policy_name) as policy_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type - by model.model_name connection_name application_name application_id - ```Evaluating severity based on policy name and guardrail ruleset type``` - | eval severity=case( - policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical", - policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high", - guardrail_ruleset_type IN ("Toxicity"), "medium", + + | rename genai_application.application_name as application_name, + connection.connection_name as connection_name + + | eval policy_name='policy.policy_name', + + guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + action=lower(event_action), message_type=lower(event_message_type), + + has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0), + + has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0), + + has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0) + + ```Prioritize allowed sensitive responses, then security and privacy guardrails``` + + | eval severity=case( + action="allow" AND has_sensitive_response=1, "critical", + action="block" AND has_sensitive_response=1, "high", + action="allow" AND has_security=1, "high", + action="block" AND has_security=1, "medium", + action="allow" AND has_privacy=1, "high", + action="block" AND has_privacy=1, "medium", true(), "low" ) - ```Calculating risk score based on severity level``` - | eval risk_score=case( - severity="critical", 100, - severity="high", 75, - severity="medium", 50, - severity="low", 25 - ) - | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name - | `cisco_ai_defense_security_alerts_by_application_name_filter` -how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype. -known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. + + | eval risk_score=case( + severity="critical", 100, + severity="high", 80, + severity="medium", 50, + severity="low", 20 + ) + + | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"), + connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0), + is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0), + is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0), + high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()), + event_time=_time + + | bin _time span=10m + + ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity``` + | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key + + ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity``` + | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5) + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(resource_type) as resource_types + values(model.model_name) as model_names + values(application_name) as application_name + values(connection_name) as connection_name + values(policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + max(risk_score) as risk_score + by _time application_key connection_key action message_type severity + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_name connection_key connection_name + action message_type severity risk_score event_count distinct_event_count event_ids + resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names + + | `cisco_ai_defense_security_alerts_by_application_name_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html @@ -57,8 +118,10 @@ intermediate_findings: - field: application_name type: other score: 20 - message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$] + message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$]. +threat_objects: [] analytic_story: + - Abuse of GenAI Systems and Applications - Critical Alerts asset_type: Web Application mitre_attack_id: [] @@ -72,7 +135,7 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json - source: cisco_ai_defense + source: not_applicable sourcetype: cisco:ai:defense - description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. - test_type: experimental + description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + test_type: unit diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml new file mode 100644 index 0000000000..872cc2f0b4 --- /dev/null +++ b/stories/abuse_of_genai_systems_and_applications.yml @@ -0,0 +1,23 @@ +name: Abuse of GenAI Systems and Applications +id: f79c6573-5550-4adc-b673-bb0d8c9e1df1 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +description: |- + Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications. + Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions. +narrative: |- + AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails. + Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available. +references: + - https://atlas.mitre.org/ + - https://owasp.org/www-project-top-10-for-large-language-model-applications/ +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From a2f5519321eb012aa073d2a18300ab9d9f051a36 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 17:48:15 +0000 Subject: [PATCH 45/52] Automated NIST AI RMF lookup table update (#4349) --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- lookups/csv/detection_subcategory_map.csv | 5 ++++- lookups/csv/detection_subcategory_map.yml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 25cf98922b..de28148840 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index dbf0a875df..e6b1ec04cc 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -2,7 +2,7 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 version: 3 creation_date: '2026-09-02' -modification_date: '2026-10-13' +modification_date: '2026-10-18' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From f41646a34626bc0b3ede1e8e9cd05f30750a6c40 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Mon, 19 Oct 2026 01:24:00 +0200 Subject: [PATCH 46/52] Add Braodo Stealer Coverage For 2026 Variant (#4320) --------- Co-authored-by: Nasreddine Bencherchali --- .../download_files_using_telegram.yml | 5 +- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- ...ell_download_from_code_hosting_service.yml | 91 +++++++++++++++ ..._autostart_execution_in_startup_folder.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 4 +- .../windows_dns_query_request_to_tinyurl.yml | 11 +- .../windows_password_managers_discovery.yml | 5 +- ...ound_connection_to_social_media_domain.yml | 107 ++++++++++++++++++ ..._dns_query_request_by_telegram_bot_api.yml | 5 +- stories/braodo_stealer.yml | 21 +++- 12 files changed, 246 insertions(+), 23 deletions(-) create mode 100644 detections/endpoint/powershell_download_from_code_hosting_service.yml create mode 100644 detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 3403eef36a..59268a324d 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,8 +1,8 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -47,6 +47,7 @@ analytic_story: - XMRig - Water Gamayun - 0bj3ctivity Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 88b6fb4b74..7bdf159487 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 31 +version: 32 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -141,6 +141,7 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 69962abd69..70c7ca2f5d 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -134,6 +134,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 87b1884b1c..c358aafab6 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 21 +version: 22 creation_date: '2021-09-15' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml new file mode 100644 index 0000000000..2611e6247e --- /dev/null +++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml @@ -0,0 +1,91 @@ +name: PowerShell Download from Code Hosting Service +id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. + These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. + A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *") + | where match( + ScriptBlockText, + "(?ix) + (?: + \.Download(?:File|Data|String)\s*\(\s*['\"]? + | + (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm) + (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]? + | + Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]? + | + (?:curl|wget)\s+(?:-Uri\s+)?['\"]? + ) + https?:// + (?: + raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)* + | + (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + | + codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + ) + \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi) + (?:[?#][^\s'\"]*)? + (?=['\"\s),;]|$)" + ) + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_download_from_code_hosting_service_filter` +how_to_implement: |- + To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted. + Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment. +known_false_positives: |- + Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg. + Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html + - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$]. +threat_objects: [] +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1059.001 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 48b6050197..6fa6786fe8 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 17 +version: 18 creation_date: '2023-01-16' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - BlankGrabber Stealer - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 354d3e7a7d..24eb9e8c80 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 15 +version: 16 creation_date: '2024-10-18' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml index cc66fe2bfe..19d561e114 100644 --- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml +++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request To TinyUrl id: b1ea79da-719c-437c-acaf-5c93f838f425 -version: 5 +version: 6 creation_date: '2021-11-18' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -22,7 +22,11 @@ search: | "*\\ProgramData\\*", "*\\Temp\\*", "*\\Users\\Public\\*", - "*\\Windows\\Tasks\\*" + "*\\Windows\\Tasks\\*", + "*\\powershell.exe", + "*\\pwsh.exe", + "*\\cmd.exe", + "*\\python.exe", ) | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count @@ -58,6 +62,7 @@ threat_objects: type: process_name analytic_story: - Malicious Inno Setup Loader + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 7ad0eb58cc..c5294dd898 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -1,8 +1,8 @@ name: Windows Password Managers Discovery id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 13 +version: 14 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -55,6 +55,7 @@ analytic_story: - Prestige Ransomware - Scattered Spider - Scattered Lapsus$ Hunters + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.005 diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml new file mode 100644 index 0000000000..20207c5a70 --- /dev/null +++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml @@ -0,0 +1,107 @@ +name: Windows Process Outbound Connection To Social Media Domain +id: d6dc231e-8595-499b-889e-cf6a055df4d4 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. + It leverages Sysmon Event ID 3 to surface this anomalous behavior. + Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. + For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. +data_source: + - Sysmon EventID 3 +search: |- + `sysmon` + EventCode=3 + Image IN ( + "*:\\$Recycle.Bin\\*", + "*:\\PerfLogs\\*", + "*:\\Users\\Administrator\\Music\\*", + "*:\\Users\\Public\\*", + "*:\\Windows\\Cursors\\*", + "*:\\Windows\\debug\\*", + "*:\\Windows\\fonts\\*", + "*:\\Windows\\INF\\*", + "*:\\Windows\\Media\\*", + "*:\\Windows\\Prefetch\\*", + "*\\Windows\\repair\\*" + ) + + process_name IN ( + "py.exe", + "pypy.exe", + "python.exe", + "python2*.exe", + "python3*.exe", + "pythonw.exe" + ) + + dest IN ( + "*.facebook.com", + "*.facebook.net", + "*.facebook.org", + "*.fb.com", + "*.fbcd.net", + "*.fbsbx.com", + "*.fbstatic-a.akamaihd.net", + "*.tfbw.net" + ) + direction = outbound + + | rename Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action app dest dest_ip dest_port direction dvc protocol protocol_version + process_path process_name process_guid process_id + src src_ip src_port transport user vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_outbound_connection_to_social_media_domain_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1586.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index dc87224238..f1d6a09ed2 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 12 +version: 13 creation_date: '2021-08-03' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index f2ffbf3f1b..c55ebb63d5 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -1,15 +1,28 @@ name: Braodo Stealer id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 -version: 2 +version: 3 creation_date: '2024-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-07' author: Teoderick Contreras, Splunk status: production -description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. -narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware. +description: |- + Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. + This malware typically targets login credentials, browser history, cookies, and stored passwords. + Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. + Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. +narrative: |- + Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. + Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. + Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications. + In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API. + Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim. + For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure. + With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts. + What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise. references: - https://bazaar.abuse.ch/browse/tag/Braodo/ - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html category: - Data Destruction - Malware From c13aa3bde996deec91af6a2ff0d0a00f01dfdca3 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 01:35:08 +0200 Subject: [PATCH 47/52] Add detection for repeated CloudWatch Logs read operations (#4288) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Bhavin Patel --- ...peated_cloudwatch_logs_read_operations.yml | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml new file mode 100644 index 0000000000..8ae7fe7b90 --- /dev/null +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -0,0 +1,112 @@ +name: AWS Repeated CloudWatch Logs Read Operations +id: 3f0ba9e1-c6cf-4317-a6bc-c4bcab2b5a06 +version: 1 +creation_date: '2026-09-21' +modification_date: '2026-09-21' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a + five-minute period. + It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. + This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="logs.amazonaws.com" + eventName IN ( + "DescribeLogGroups", + "DescribeLogStreams", + "DownloadLogEvents", + "FilterLogEvents", + "GetLogEvents", + "GetQueryResults" + ) + + | eval user='userIdentity.principalId' + | eval vendor_account=coalesce( + vendor_account, + recipientAccountId, + 'userIdentity.accountId' + ) + | eval role_name='userIdentity.sessionContext.sessionIssuer.userName' + | eval signature=coalesce(signature, eventName) + | eval src=coalesce(src, sourceIPAddress) + | eval user_agent=coalesce(user_agent, userAgent) + | eval vendor_region=coalesce(vendor_region, awsRegion) + + | where isnotnull(user) AND len(trim(user)) > 0 + + | dedup eventID keepempty=true + + | sort 0 _time + + | streamstats time_window=5m count AS event_count + by user vendor_account + + | where event_count > 500 + + | stats max(_time) AS lastTime + max(event_count) AS event_count + min(_time) AS firstTime + values(role_name) AS role_name + values(signature) AS api_operations + values(src) AS src + values(user_agent) AS user_agent + values(vendor_region) AS vendor_region + by user vendor_account + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_repeated_cloudwatch_logs_read_operations_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read + CloudWatch Logs and generate a high volume of matching operations. + The prevalence of this activity has not yet been evaluated against broader customer telemetry. + Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating. +references: + - https://attack.mitre.org/techniques/T1530/ + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html +drilldown_searches: + - name: View CloudWatch Logs read operations for - "$user$" + search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The AWS principal [$user$] performed [$event_count$] CloudWatch Logs read operations + entity: + field: user + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Data Exfiltration +asset_type: AWS Account +mitre_attack_id: + - T1530 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From d0a1a07ca3e95b253a8d97d99360d91b7c74b8f8 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 01:36:36 +0200 Subject: [PATCH 48/52] Add AWS EC2 Instance Connect key upload detection (#4312) --------- Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- ...lic_keys_uploaded_by_a_single_identity.yml | 75 +++++++++++ ...up_script_modified_on_stopped_instance.yml | 93 +++++++++++++ ...s_iam_role_created_with_external_trust.yml | 122 ++++++++++++++++++ 3 files changed, 290 insertions(+) create mode 100644 detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml create mode 100644 detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml create mode 100644 detections/cloud/aws_iam_role_created_with_external_trust.yml diff --git a/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml new file mode 100644 index 0000000000..ecb853e891 --- /dev/null +++ b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml @@ -0,0 +1,75 @@ +name: AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity +id: 62afb4a9-d9d0-464a-9326-aacf61c5a9f2 +version: 1 +creation_date: '2026-09-29' +modification_date: '2026-09-29' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. + EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. + A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="ec2-instance-connect.amazonaws.com" + eventName="SendSSHPublicKey" + responseElements.success=true + + | stats dc('requestParameters.instanceId') as unique_instances + dc(eventID) as event_count + earliest(_time) as firstTime + latest(_time) as lastTime + values('requestParameters.instanceId') as targeted_instances + values('requestParameters.instanceOSUser') as targeted_users + values(src) as src + values(user_agent) as user_agent + values(vendor_region) as vendor_region + by user_arn + + | where event_count >= 10 + + | eval duration_seconds=lastTime-firstTime + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Administrators and automated orchestration may legitimately use EC2 Instance Connect repeatedly during fleet administration, troubleshooting, + or ephemeral-access workflows. + Review the AWS identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process. +references: + - https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html + - https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/ + - https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-14-aws-ec2-instance-connect-ssh-public-key-uploaded.html +finding: + title: The AWS identity [$user_arn$] uploaded [$event_count$] SSH public keys using EC2 Instance Connect + entity: + field: user_arn + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Suspicious Cloud Instance Activities +asset_type: AWS Account +mitre_attack_id: + - T1021.004 + - T1021.008 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit diff --git a/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml new file mode 100644 index 0000000000..ec33d41248 --- /dev/null +++ b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml @@ -0,0 +1,93 @@ +name: AWS EC2 Startup Script Modified on Stopped Instance +id: 84578867-02bf-475e-9815-6e8e0d798253 +version: 1 +creation_date: '2026-10-07' +modification_date: '2026-10-07' +author: Maria Jose Erquiaga +status: production +type: TTP +description: |- + A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal. + This may indicate an attempt to change instance startup behavior or establish persistence. + These CloudTrail events do not confirm that the modified user-data script executed. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="ec2.amazonaws.com" + eventName IN ("StopInstances", "ModifyInstanceAttribute") + + | eval user_arn='userIdentity.arn' + + | eval instance_id=case( + eventName="StopInstances", 'requestParameters.instancesSet.items{}.instanceId', + eventName="ModifyInstanceAttribute", 'requestParameters.instanceId' + ) + + | mvexpand instance_id + + | where isnotnull(eventID) AND isnotnull(instance_id) AND isnotnull(user_arn) + AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") + + | where eventName="StopInstances" + OR (eventName="ModifyInstanceAttribute" AND 'requestParameters.attribute'="userData") + + | dedup eventID instance_id + + | eval event_epoch=coalesce(strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ"), _time) + + | sort 0 user_arn instance_id awsRegion event_epoch + + | streamstats current=f + last(eval(if(eventName="StopInstances", event_epoch, null()))) AS stop_epoch + last(eval(if(eventName="StopInstances", eventID, null()))) AS stop_event_id + BY user_arn instance_id awsRegion + + | where eventName="ModifyInstanceAttribute" AND isnotnull(stop_epoch) + + | eval elapsed_seconds=event_epoch-stop_epoch + + | where elapsed_seconds>0 AND elapsed_seconds<=3600 + + | eval stop_time_utc=strftime(stop_epoch, "%Y-%m-%dT%H:%M:%SZ") + + | eval modification_time_utc=strftime(event_epoch, "%Y-%m-%dT%H:%M:%SZ") + + | rename eventID AS modification_event_id + + | table user_arn instance_id awsRegion stop_time_utc modification_time_utc + elapsed_seconds stop_event_id modification_event_id + + | `aws_ec2_startup_script_modified_on_stopped_instance_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Authorized administrators and infrastructure automation may stop instances and update their user data. + Review the IAM principal, instance, change window, and approved automation before escalating. +references: + - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html + - https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-user-data/ +finding: + title: The IAM principal [$user_arn$] modified user data on stopped EC2 instance [$instance_id$] + entity: + field: user_arn + type: user + score: 50 +threat_objects: [] +analytic_story: + - Suspicious Cloud User Activities +asset_type: AWS Account +mitre_attack_id: + - T1578.005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit diff --git a/detections/cloud/aws_iam_role_created_with_external_trust.yml b/detections/cloud/aws_iam_role_created_with_external_trust.yml new file mode 100644 index 0000000000..2cd8511116 --- /dev/null +++ b/detections/cloud/aws_iam_role_created_with_external_trust.yml @@ -0,0 +1,122 @@ +name: AWS IAM Role Created with External Trust +id: 6b7f646b-5ddc-48c9-baa3-fd66ac202c18 +version: 1 +creation_date: '2026-10-13' +modification_date: '2026-10-13' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard + principal. + This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="iam.amazonaws.com" + eventName="CreateRole" + + | where isnull(errorCode) OR errorCode="" OR lower(errorCode)="success" + + | eval policy_raw='requestParameters.assumeRolePolicyDocument', + role_name='requestParameters.roleName', + role_arn='responseElements.role.arn', + user_arn=coalesce(user_arn, 'userIdentity.arn'), + src=coalesce(src, sourceIPAddress) + + | where isnotnull(policy_raw) + + | eval policy=if(match(policy_raw, "(?i)^%7b"), urldecode(policy_raw), policy_raw) + + | rex field=role_arn "^arn:[^:]+:iam::(?[0-9]{12}):role/" + + | eval role_account_id=coalesce(account_from_role_arn, recipientAccountId) + | eval statements_json=json_extract(policy, "Statement") + | eval statements=if(match(statements_json, "^\s*\["), json_array_to_mv(statements_json), statements_json) + + | mvexpand statements + + | eval effect=json_extract(statements, "Effect"), + actions_json=json_extract(statements, "Action"), + principal_json=json_extract(statements, "Principal") + + | eval actions=if(match(actions_json, "^\s*\["), json_array_to_mv(actions_json, true()), actions_json) + + | mvexpand actions + | mvexpand actions + + | eval trust_action=actions + | eval action_pattern=replace(replace(lower(trust_action), "[*]", "%"), "[?]", "_") + + | where effect="Allow" AND like("sts:assumerole", action_pattern) + | eval aws_json=json_extract(principal_json, "AWS") + + | eval principals=case( + match(aws_json, "^\s*\["), json_array_to_mv(aws_json, true()), + isnotnull(aws_json), aws_json, + principal_json="*", "*" + ) + + | mvexpand principals + + | eval trust_principal=principals + + | rex field=trust_principal "^arn:[^:]+:iam::(?[0-9]{12}):" + + | eval principal_account_id=if( + match(trust_principal, "^[0-9]{12}$"), + trust_principal, + principal_account_from_arn + ) + + | eval trust_type=case( + trust_principal="*", "wildcard", + isnotnull(role_account_id) AND isnotnull(principal_account_id) + AND principal_account_id!=role_account_id, "external" + ) + + | where trust_type="wildcard" OR trust_type="external" + + | eval event_key=coalesce(eventID, md5(_raw)) + + | dedup event_key trust_principal + + | table _time eventID user_arn src role_name role_arn role_account_id + trust_type trust_principal principal_account_id trust_action + + | `aws_iam_role_created_with_external_trust_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Approved cross-account integrations and deliberately configured wildcard trust may match. + Review the role owner, trust-policy conditions, role permissions, and whether the principal is expected. +references: + - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html + - https://stratus-red-team.cloud/attack-techniques/aws/aws.persistence.iam-backdoor-role/ +finding: + title: The AWS IAM role [$role_name$] created with [$trust_type$] trust + entity: + field: user_arn + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - AWS IAM Privilege Escalation +asset_type: AWS Account +mitre_attack_id: + - T1098.003 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From 16978b0714436c8955b4ed48e8b6567f5dee2707 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 02:03:27 +0200 Subject: [PATCH 49/52] Add AWS CloudTrail behavioral detections (#4297) --- ...malous_secrets_manager_batch_retrieval.yml | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml diff --git a/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml new file mode 100644 index 0000000000..9243a8a30d --- /dev/null +++ b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml @@ -0,0 +1,111 @@ +name: AWS Anomalous Secrets Manager Batch Retrieval +id: 93646bda-291b-4a59-a926-19f08e26f7cd +version: 1 +creation_date: '2026-09-29' +modification_date: '2026-09-29' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: >- + The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within + one hour. + It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. + Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventName="BatchGetSecretValue" + eventSource="secretsmanager.amazonaws.com" + + | eval user_arn='userIdentity.arn', + vendor_account=recipientAccountId + + | where isnotnull(user_arn) AND isnotnull(vendor_account) + AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") + + | eval event_key=coalesce(eventID, md5(_raw)) + + | dedup event_key + + | eval event_time=_time + + | sort 0 + _time + + | streamstats time_window=1h count AS rolling_batch_request_count + min(event_time) AS window_start + BY vendor_account user_arn + + | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end + BY vendor_account user_arn + + | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start + BY vendor_account user_arn + + | where isnotnull(qualifying_start) + AND event_time>=qualifying_start + AND event_time<=qualifying_end + + | stats count AS batch_request_count + values(sourceIPAddress) AS src + values(userAgent) AS user_agent + values(awsRegion) AS vendor_region + earliest(event_time) AS firstTime + latest(event_time) AS lastTime + + BY vendor_account user_arn + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_anomalous_secrets_manager_batch_retrieval_filter` +how_to_implement: |- + Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype. +known_false_positives: |- + Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time. + A principal may trigger the detection again when it has not used the API during the preceding seven days. + Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized. +references: + - https://attack.mitre.org/techniques/T1555/006/ + - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html + - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html + - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html +drilldown_searches: + - name: View detection results for - "$user_arn$" + search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View Secrets Manager activity for the last 7 days for - "$user_arn$" + search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters' + earliest_offset: 7d + latest_offset: "0" + - name: View risk events for the last 7 days for - "$user_arn$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour + entity: + field: user_arn + type: user + score: 40 +threat_objects: + - field: src + type: ip_address +analytic_story: + - AWS Identity and Access Management Account Takeover +asset_type: AWS Account +mitre_attack_id: + - T1555.006 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + test_type: unit From 12d9cd55a32f225b45c51a50ab8a18c901addd49 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 19 Oct 2026 11:58:56 +0200 Subject: [PATCH 50/52] Add New Dashboard Leveraging AI Defense Data/Content (#4350) --- app_template/default/data/ui/nav/default.xml | 1 + .../cisco_ai_defense_threat_operations.json | 1010 +++++++++++++++++ .../cisco_ai_defense_threat_operations.yml | 9 + 3 files changed, 1020 insertions(+) create mode 100644 dashboards/cisco_ai_defense_threat_operations.json create mode 100644 dashboards/cisco_ai_defense_threat_operations.yml diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 1738ee9068..c4aeaca59d 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -4,6 +4,7 @@ + diff --git a/dashboards/cisco_ai_defense_threat_operations.json b/dashboards/cisco_ai_defense_threat_operations.json new file mode 100644 index 0000000000..3f12be5c23 --- /dev/null +++ b/dashboards/cisco_ai_defense_threat_operations.json @@ -0,0 +1,1010 @@ +{ + "title": "Cisco AI Defense Threat Operations", + "description": "Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections.\n\nThis dashboard uses the `cisco_ai_defense` macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use.", + "dataSources": { + "ds_filter_applications": { + "type": "ds.search", + "name": "Available AI applications", + "options": { + "query": "`cisco_ai_defense`\n| spath path=\"genai_application.application_name\" output=Application\n| eval Application=if(isnull(Application) OR len(trim(Application))=0,if(isnull(application_id) OR len(trim(application_id))=0,\"Unknown application\",application_id),Application)\n| eval application_key=if(isnull(application_id) OR len(trim(application_id))=0,Application,application_id)\n| stats count as event_count values(Application) as application_names values(application_id) as application_id by application_key\n| eval Application=mvjoin(application_names,\" / \")\n| table Application application_key application_id event_count\n| sort 0 Application" + } + }, + "ds_filter_models": { + "type": "ds.search", + "name": "Available AI models", + "options": { + "query": "`cisco_ai_defense` | search model.model_name!=\"\" | stats count as event_count by model.model_name | rename model.model_name as model_name | table model_name event_count | sort 0 model_name" + } + }, + "ds_ai_events_base": { + "type": "ds.search", + "name": "Cisco AI Defense normalized event base", + "options": { + "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards" + } + }, + "ds_total_events": { + "type": "ds.chain", + "name": "Total observed events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as count" + } + }, + "ds_blocked_events": { + "type": "ds.chain", + "name": "Blocked events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(eval(if(action=\"block\",event_id,null()))) as count" + } + }, + "ds_allowed_highrisk": { + "type": "ds.chain", + "name": "Allowed high-risk events", + "options": { + "extend": "ds_ai_events_base", + "query": "| eval is_highrisk=if(mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND is_highrisk=1,event_id,null()))) as count" + } + }, + "ds_allowed_sensitive_responses": { + "type": "ds.chain", + "name": "Allowed sensitive responses", + "options": { + "extend": "ds_ai_events_base", + "query": "| eval is_privacy=if(mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND direction=\"response\" AND is_privacy=1,event_id,null()))) as count" + } + }, + "ds_redacted_events": { + "type": "ds.chain", + "name": "Redacted events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(eval(if(action=\"redact\",event_id,null()))) as count" + } + }, + "ds_runtime_actions": { + "type": "ds.chain", + "name": "Runtime actions over time", + "options": { + "extend": "ds_ai_events_base", + "query": "| timechart span=1h dc(event_id) as events by action" + } + }, + "ds_sensitive_entities": { + "type": "ds.chain", + "name": "Sensitive entities by action", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| mvexpand entities\n| where isnotnull(entities) AND len(trim(entities))>0\n| chart dc(event_id) over entities by action\n| fillnull value=0" + } + }, + "ds_sensitive_event_details": { + "type": "ds.chain", + "name": "Sensitive match review", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval rulesets=mvjoin(guardrails,\", \"), detected_entities=mvjoin(entities,\", \")\n| sort 0 - _time\n| table _time action direction application_name application_id connection_name model_name policy_name rulesets detected_entities event_id\n| head 100" + } + }, + "ds_applications_by_action": { + "type": "ds.chain", + "name": "Observed applications by event volume", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as events values(application_name) as application_names values(application_id) as application_ids values(action) as actions values(model_name) as models by application_key\n| eval application_name=mvjoin(application_names,\" / \"), application_id=mvjoin(application_ids,\", \")\n| eval actions=mvjoin(mvsort(actions),\", \"), models=mvjoin(mvsort(models),\", \")\n| sort 0 - events\n| head 15\n| rename application_name as Application application_id as \"Application ID\" events as Events actions as Actions models as \"Models observed\"\n| table Application \"Application ID\" Events Actions \"Models observed\"" + } + }, + "ds_models_by_action": { + "type": "ds.chain", + "name": "Observed events by model and action", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as events by model_name action\n| chart max(events) over model_name by action\n| fillnull value=0" + } + }, + "ds_ai_detection_readiness": { + "type": "ds.search", + "name": "ESCU AI Defense detection readiness", + "options": { + "query": "| makeresults\n| eval detection_name=split(\"Cisco AI Defense Security Alerts by Application Name|Cisco AI Defense Repeated High Risk Activity|Cisco AI Defense Allowed Sensitive Response|Cisco AI Defense Allowed Sensitive Prompt\",\"|\")\n| mvexpand detection_name\n| eval expected_savedsearch=\"ESCU - \".detection_name.\" - Rule\", ai_system=\"Cisco AI Defense\", mapped=1, data_sources=\"Cisco AI Defense Alerts\"\n| fields ai_system detection_name expected_savedsearch mapped data_sources\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | where title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\"), app_name=coalesce('eai:acl.app','eai:appName',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window app_name ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window values(app_name) as app_name by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\"), scheduled=coalesce(mvindex(scheduled,0),\"Missing\"), finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\",enabled!=\"Enabled\",\"Disabled\",scheduled!=\"Scheduled\",\"Not scheduled\",finding_output==\"No risk/notable\",\"No risk/notable action\",true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \"), schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\"), app_name=coalesce(mvindex(app_name,0),\"\")\n| sort readiness detection_name\n| rename detection_name as Detection expected_savedsearch as \"Saved Search\" readiness as Readiness finding_output as \"Finding Output\" schedule as Schedule window as Window app_name as App data_sources as \"Data Sources\"\n| table Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window App \"Data Sources\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + } + }, + "ds_live_ai_findings_base": { + "type": "ds.search", + "name": "Cisco AI Defense ESCU risk and notable results", + "options": { + "query": "search (index=risk OR index=notable)\n [ | makeresults\n | eval savedsearch_title=mvappend(\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\", \"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | mvexpand savedsearch_title\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0,\"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\",\"source=\\\"__cisco_ai_defense_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"Risk event\",index=\"notable\",\"Notable\",true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),search_name,null()),if(match(source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),source,null()),if(match(savedsearch_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),savedsearch_name,null()),if(match(orig_source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),orig_source,null()),if(match(rule_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),rule_name,null()))\n| where savedsearch_title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n| eval detection=replace(replace(savedsearch_title,\"^ESCU - \",\"\"),\" - Rule$\",\"\")\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score,risk_score))\n| eval severity=case(finding_source=\"Risk event\",lower(coalesce(severity,case(risk_numeric>=80,\"critical\",risk_numeric>=50,\"high\",risk_numeric>=20,\"medium\",risk_numeric>0,\"low\",true(),\"unknown\"))),finding_source=\"Notable\",lower(coalesce(severity,urgency,\"unknown\")),true(),lower(coalesce(severity,\"unknown\")))\n| eval entity=case(finding_source=\"Risk event\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"),finding_source=\"Notable\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,rule_name,\"unknown\"),true(),coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"))\n| eval detail=case(finding_source=\"Risk event\",coalesce(risk_message,source,search_name,detection,\"\"),finding_source=\"Notable\",coalesce(rule_description,description,rule_name,detection,\"\"),true(),coalesce(risk_message,rule_description,source,detection,\"\"))\n| eval detail=substr(detail,1,500), event_key=coalesce(event_id,source_event_id,sid,_cd,tostring(_time).\"|\".savedsearch_title.\"|\".entity.\"|\".coalesce(detail,\"\"))\n| dedup event_key detection\n| fields _time finding_source detection severity risk_numeric entity detail savedsearch_title" + } + }, + "ds_live_findings_by_detection": { + "type": "ds.chain", + "name": "ESCU finding counts by detection", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| stats count as Findings dc(entity) as Entities by detection finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval detection=\"No matching detection results\", finding_source=\"Status\", Findings=0, Entities=0 | fields - result_count ]\n| sort 0 - Findings" + } + }, + "ds_live_findings_over_time": { + "type": "ds.chain", + "name": "ESCU findings over time", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| timechart span=1d count by finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval _time=now(), \"No detection results\"=0 | fields _time \"No detection results\" ]\n| fillnull value=0" + } + }, + "ds_live_findings_detail": { + "type": "ds.chain", + "name": "Recent ESCU AI Defense Findings", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort 0 -_time\n| table eventTime finding_source severity detection entity risk_numeric detail\n| appendpipe [ | stats count as result_count | where result_count==0 | eval eventTime=\"\", finding_source=\"Status\", severity=\"info\", detection=\"No matching detection results\", entity=\"No risk/notable events in selected time window\", risk_numeric=0, detail=\"This table populates when one of the four Cisco AI Defense ESCU detections produces risk or notable output.\" | fields - result_count ]" + } + }, + "ds_attack_outcomes": { + "type": "ds.chain", + "name": "High-risk activity by enforcement outcome", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(eval(if(action=\"allow\",event_id,null()))) as count" + } + }, + "ds_blocked_attack_outcomes": { + "type": "ds.chain", + "name": "Blocked high-risk activity", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"block\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count" + } + }, + "ds_allowed_sensitive_response_count": { + "type": "ds.chain", + "name": "Allowed sensitive responses", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"allow\" AND direction=\"response\" AND mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count" + } + }, + "ds_repeated_event_ids": { + "type": "ds.chain", + "name": "Repeated high-risk event IDs", + "options": { + "extend": "ds_ai_events_base", + "query": "| where isnotnull(event_id) AND len(trim(event_id))>0 AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| bin _time span=10m\n| stats count as Occurrences values(application_name) as application_names values(application_id) as application_ids values(connection_name) as connection_names values(connection_id) as connection_ids values(action) as Actions values(direction) as Directions values(guardrails) as Guardrails values(model_name) as Models by _time application_key connection_key event_id\n| eval application_name=mvjoin(application_names,\" / \"), connection_name=mvjoin(connection_names,\" / \"), application_id=mvjoin(application_ids,\", \"), connection_id=mvjoin(connection_ids,\", \")\n| where Occurrences>=3\n| eval Window=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| rename application_name as Application connection_name as Connection event_id as \"Event ID\"\n| table Window Application Connection \"Event ID\" Occurrences Actions Directions Guardrails Models\n| sort 0 - Occurrences\n| head 100" + } + }, + "ds_attack_paths": { + "type": "ds.search", + "name": "Risky behavior by direction and policy outcome", + "options": { + "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards\n| mvexpand guardrails\n| eval attack_class=case(match(guardrails,\"(?i)prompt injection\"),\"Prompt injection\",match(guardrails,\"(?i)code detection\"),\"Code generation or abuse\",match(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\"),\"Sensitive data (PII/PCI)\",true(),null())\n| where isnotnull(attack_class)\n| eval attack_path=attack_class.\" / \".coalesce(direction,\"unknown\")\n| stats dc(event_id) as events by attack_path action\n| chart max(events) over attack_path by action\n| fillnull value=0\n| sort 0 attack_path" + } + }, + "ds_allowed_risk_cases": { + "type": "ds.chain", + "name": "Allowed high-risk paths for review", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"allow\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval attack_class=case(mvfind(guardrails,\"(?i)prompt injection\")>=0,\"Prompt injection\",mvfind(guardrails,\"(?i)code detection\")>=0,\"Code generation or abuse\",mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,\"Sensitive data (PII/PCI)\",true(),\"Other high-risk\")\n| stats dc(event_id) as Events values(application_id) as application_ids values(application_name) as application_names values(direction) as Directions values(guardrails) as Guardrails values(entities) as Entities values(policy_name) as Policies values(connection_name) as Connections by application_key model_name attack_class\n| eval application_id=mvjoin(application_ids,\", \")\n| eval Application=mvjoin(application_names,\" / \"), \"Application ID\"=mvjoin(application_ids,\", \")\n| eval Directions=mvjoin(Directions,\", \"), Guardrails=mvjoin(Guardrails,\", \"), Entities=mvjoin(Entities,\", \"), Policies=mvjoin(Policies,\", \"), Connections=mvjoin(Connections,\", \")\n| rename model_name as Model attack_class as \"Attack class\"\n| sort 0 - Events\n| head 100\n| table Application \"Application ID\" Model \"Attack class\" Events Directions Guardrails Entities Policies Connections" + } + } + }, + "visualizations": { + "viz_threat_header": { + "type": "splunk.markdown", + "options": { + "markdown": "## Cisco AI Defense | Threat Overview\nRuntime enforcement, allowed high-risk activity, and sensitive response signals. Use Application and Model filters to focus event telemetry." + } + }, + "viz_total_events": { + "type": "splunk.singlevalue", + "title": "Events Observed", + "description": "Distinct Cisco AI Defense event IDs in the selected time range.", + "dataSources": { + "primary": "ds_total_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_blocked_events": { + "type": "splunk.singlevalue", + "title": "Blocked Events", + "description": "Distinct events blocked by AI Defense.", + "dataSources": { + "primary": "ds_blocked_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_allowed_highrisk": { + "type": "splunk.singlevalue", + "title": "Allowed High-Risk Events", + "description": "Allowed events matching prompt-injection, code, PII, or PCI guardrails.", + "dataSources": { + "primary": "ds_allowed_highrisk" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_allowed_sensitive_responses": { + "type": "splunk.singlevalue", + "title": "Sensitive Responses Allowed", + "description": "Allowed responses matching PII or PCI privacy guardrails.", + "dataSources": { + "primary": "ds_allowed_sensitive_responses" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_repeat_window_count": { + "type": "splunk.singlevalue", + "title": "Redacted Events", + "description": "Distinct events redacted by AI Defense in the selected time range.", + "dataSources": { + "primary": "ds_redacted_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_risk_timeline": { + "type": "splunk.line", + "title": "Runtime Enforcement Over Time", + "description": "Hourly volume by observed action. This includes all events, not only high-risk matches.", + "dataSources": { + "primary": "ds_runtime_actions" + }, + "options": { + "legendDisplay": "bottom", + "xAxisTitleText": "Time", + "yAxisTitleText": "Events", + "seriesColorsByField": { + "block": "#D64545", + "allow": "#3B82F6", + "redact": "#F59E0B", + "monitor": "#2F9E76" + } + } + }, + "viz_sensitive_entities": { + "type": "splunk.bar", + "title": "Sensitive Entities by Action", + "description": "PII/PCI entity categories observed in events; message content is not shown.", + "dataSources": { + "primary": "ds_sensitive_entities" + }, + "options": { + "legendDisplay": "bottom", + "xAxisTitleVisibility": "hide", + "yAxisTitleText": "Distinct events", + "stackMode": "stacked", + "seriesColorsByField": { + "allow": "#F59E0B", + "block": "#D64545", + "redact": "#2F9E76" + } + } + }, + "viz_repeat_windows": { + "type": "splunk.table", + "title": "Sensitive Match Review", + "description": "Event-level PII/PCI matches with application, model, policy, and entity metadata. Prompt and response text is omitted.", + "dataSources": { + "primary": "ds_sensitive_event_details" + }, + "options": { + "headerVisibility": "fixed", + "count": 50, + "wrap": true + } + }, + "viz_priority_queue": { + "type": "splunk.table", + "title": "Recent ESCU AI Defense Findings", + "description": "Actual risk or notable records attributed to the four Cisco AI Defense ESCU detections. The empty state is informational, not a synthetic finding.", + "dataSources": { + "primary": "ds_live_findings_detail" + }, + "options": { + "headerVisibility": "fixed", + "count": 50, + "wrap": true + } + }, + "viz_header_attack_activity": { + "type": "splunk.markdown", + "options": { + "markdown": "## Attack Activity\n\n### Prompt or Response → Guardrail Match → Policy Action\n\nCompare risky behavior with enforcement outcomes, then review allowed paths and repeated event IDs. Counts describe observed events; the dashboard does not infer a successful compromise." + } + }, + "viz_header_data_exposure": { + "type": "splunk.markdown", + "options": { + "markdown": "## Data Exposure\nReview PII/PCI entities and affected applications, models, policies, and event direction. Payload text is intentionally excluded." + } + }, + "viz_apps_activity": { + "type": "splunk.table", + "title": "Most Active Observed Applications", + "dataSources": { + "primary": "ds_applications_by_action" + }, + "options": { + "count": 15, + "drilldown": "none", + "wrap": true + }, + "description": "Applications observed in Cisco AI Defense runtime events." + }, + "viz_models_activity": { + "type": "splunk.bar", + "title": "Observed Activity by Model and Action", + "dataSources": { + "primary": "ds_models_by_action" + }, + "options": { + "legendDisplay": "bottom", + "seriesColorsByField": { + "allow": "#3B82F6", + "block": "#D64545", + "redact": "#F59E0B", + "monitor": "#2F9E76" + } + }, + "description": "Model names are taken from runtime events; unknown means the model field was not present." + }, + "viz_detection_readiness": { + "type": "splunk.table", + "title": "Configured Detection Status", + "dataSources": { + "primary": "ds_ai_detection_readiness" + }, + "options": { + "count": 10, + "drilldown": "none", + "wrap": true, + "columnFormat": { + "Readiness": { + "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColorConfig)" + } + } + }, + "description": "Shows whether each expected saved search is present, enabled, scheduled, and configured for risk/notable output. Requires saved-search REST visibility.", + "context": { + "ReadinessColorConfig": [ + { + "match": "Ready", + "value": "#4C8B5B" + }, + { + "match": "Disabled", + "value": "#B5432F" + }, + { + "match": "Missing saved search", + "value": "#B5432F" + }, + { + "match": "Not scheduled", + "value": "#C99A3B" + }, + { + "match": "No risk/notable action", + "value": "#C99A3B" + } + ] + } + }, + "viz_findings_by_detection": { + "type": "splunk.bar", + "title": "Generated Findings by Detection and Source", + "dataSources": { + "primary": "ds_live_findings_by_detection" + }, + "options": { + "legendDisplay": "bottom", + "stackMode": "stacked", + "seriesColorsByField": { + "Risk event": "#C99A3B", + "Notable": "#B5432F" + } + }, + "description": "Risk and notable events attributed to the Cisco AI Defense detections." + }, + "viz_findings_over_time": { + "type": "splunk.line", + "title": "Detection Output Over Time", + "dataSources": { + "primary": "ds_live_findings_over_time" + }, + "options": { + "legendDisplay": "bottom", + "seriesColorsByField": { + "Risk event": "#C99A3B", + "Notable": "#B5432F", + "No detection results": "#C9CDD1" + } + }, + "description": "Daily risk and notable events generated by these detections." + }, + "viz_header_app_model": { + "type": "splunk.markdown", + "options": { + "markdown": "## Application and Model Activity\nExplore Cisco AI Defense runtime event volume across observed applications and models." + } + }, + "viz_header_detection_activity": { + "type": "splunk.markdown", + "options": { + "markdown": "## Detection Coverage and Outcomes\nReview configured Cisco AI Defense detections and the risk or notable events they generate." + } + }, + "viz_allowed_risk_count": { + "type": "splunk.singlevalue", + "title": "Allowed High-Risk Events", + "description": "Distinct allowed events matching prompt injection, code, PII, or PCI guardrails.", + "dataSources": { + "primary": "ds_attack_outcomes" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#2B755C" + }, + { + "from": 1, + "value": "#A33D3D" + } + ] + } + }, + "viz_blocked_risk_count": { + "type": "splunk.singlevalue", + "title": "Blocked High-Risk Events", + "description": "Distinct high-risk events blocked by AI Defense.", + "dataSources": { + "primary": "ds_blocked_attack_outcomes" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#263B46" + }, + { + "from": 1, + "value": "#197B72" + } + ] + } + }, + "viz_allowed_sensitive_response_count": { + "type": "splunk.singlevalue", + "title": "Sensitive Responses Allowed", + "description": "Distinct allowed responses matching PII or PCI guardrails.", + "dataSources": { + "primary": "ds_allowed_sensitive_response_count" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#263B46" + }, + { + "from": 1, + "value": "#A33D3D" + } + ] + } + }, + "viz_attack_paths": { + "type": "splunk.bar", + "title": "Risky Behavior by Direction and Policy Outcome", + "description": "Distinct events classified from prompt-injection, code, and PII/PCI guardrails.", + "dataSources": { + "primary": "ds_attack_paths" + }, + "options": { + "legendDisplay": "bottom", + "stackMode": "stacked", + "seriesColorsByField": { + "allow": "#D96C5F", + "block": "#47B8AE", + "monitor": "#D6A443", + "redact": "#8D7BD6" + } + } + }, + "viz_allowed_risk_cases": { + "type": "splunk.table", + "title": "Allowed High-Risk Paths Requiring Review", + "description": "Allowed events grouped by application, model, guardrail, and message direction. Message content is excluded.", + "dataSources": { + "primary": "ds_allowed_risk_cases" + }, + "options": { + "headerVisibility": "fixed", + "count": 25, + "wrap": true + } + }, + "viz_repeated_event_ids": { + "type": "splunk.table", + "title": "Repeated High-Risk Event IDs", + "description": "Event IDs with three or more high-risk occurrences in a ten-minute bucket, matching the repeated-activity detection threshold.", + "dataSources": { + "primary": "ds_repeated_event_ids" + }, + "options": { + "headerVisibility": "fixed", + "count": 25, + "wrap": true + } + } + }, + "inputs": { + "input_global_time": { + "type": "input.timerange", + "title": "Time range", + "options": { + "token": "global_time", + "defaultValue": "-7d@d,now" + } + }, + "input_application": { + "type": "input.multiselect", + "title": "Application", + "options": { + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "application_tok", + "defaultValue": "*", + "clearDefaultOnSelection": true + }, + "dataSources": { + "primary": "ds_filter_applications" + }, + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"Application\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"application_key\") | renameSeries(\"value\") | formatByType(formattedConfig)" + } + }, + "input_model": { + "type": "input.multiselect", + "title": "Model", + "options": { + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "model_tok", + "defaultValue": "*", + "clearDefaultOnSelection": true + }, + "dataSources": { + "primary": "ds_filter_models" + }, + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"model_name\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"model_name\") | renameSeries(\"value\") | formatByType(formattedConfig)" + } + } + }, + "layout": { + "tabs": { + "items": [ + { + "layoutId": "layout_overview", + "label": "Threat Overview" + }, + { + "layoutId": "layout_attack_activity", + "label": "Attack Activity" + }, + { + "layoutId": "layout_data_exposure", + "label": "Data Exposure" + }, + { + "layoutId": "layout_app_model", + "label": "Applications & Models" + }, + { + "layoutId": "layout_detection_activity", + "label": "ESCU Detection Coverage" + } + ] + }, + "layoutDefinitions": { + "layout_overview": { + "type": "absolute", + "options": { + "height": 900, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_threat_header", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_total_events", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_blocked_events", + "type": "block", + "position": { + "x": 288, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_allowed_highrisk", + "type": "block", + "position": { + "x": 576, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_allowed_sensitive_responses", + "type": "block", + "position": { + "x": 864, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_repeat_window_count", + "type": "block", + "position": { + "x": 1152, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_risk_timeline", + "type": "block", + "position": { + "x": 0, + "y": 230, + "w": 1440, + "h": 600 + } + } + ] + }, + "layout_attack_activity": { + "type": "absolute", + "options": { + "height": 1050, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_attack_activity", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 110 + } + }, + { + "item": "viz_allowed_risk_count", + "type": "block", + "position": { + "x": 0, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_blocked_risk_count", + "type": "block", + "position": { + "x": 480, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_allowed_sensitive_response_count", + "type": "block", + "position": { + "x": 960, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_attack_paths", + "type": "block", + "position": { + "x": 0, + "y": 265, + "w": 1440, + "h": 360 + } + }, + { + "item": "viz_allowed_risk_cases", + "type": "block", + "position": { + "x": 0, + "y": 635, + "w": 720, + "h": 390 + } + }, + { + "item": "viz_repeated_event_ids", + "type": "block", + "position": { + "x": 720, + "y": 635, + "w": 720, + "h": 390 + } + } + ] + }, + "layout_data_exposure": { + "type": "absolute", + "options": { + "height": 980, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_data_exposure", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_sensitive_entities", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 1440, + "h": 350 + } + }, + { + "item": "viz_repeat_windows", + "type": "block", + "position": { + "x": 0, + "y": 450, + "w": 1440, + "h": 480 + } + } + ] + }, + "layout_app_model": { + "type": "absolute", + "options": { + "height": 1120, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_app_model", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_apps_activity", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 1440, + "h": 470 + } + }, + { + "item": "viz_models_activity", + "type": "block", + "position": { + "x": 0, + "y": 570, + "w": 1440, + "h": 470 + } + } + ] + }, + "layout_detection_activity": { + "type": "absolute", + "options": { + "height": 1350, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_detection_activity", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 100 + } + }, + { + "item": "viz_detection_readiness", + "type": "block", + "position": { + "x": 0, + "y": 110, + "w": 1440, + "h": 300 + } + }, + { + "item": "viz_findings_by_detection", + "type": "block", + "position": { + "x": 0, + "y": 420, + "w": 720, + "h": 340 + } + }, + { + "item": "viz_findings_over_time", + "type": "block", + "position": { + "x": 720, + "y": 420, + "w": 720, + "h": 340 + } + }, + { + "item": "viz_priority_queue", + "type": "block", + "position": { + "x": 0, + "y": 770, + "w": 1440, + "h": 520 + } + } + ] + } + }, + "globalInputs": [ + "input_global_time", + "input_application", + "input_model" + ], + "options": { + "submitButton": true, + "submitOnDashboardLoad": true, + "showTitleAndDescription": true + } + }, + "defaults": { + "dataSources": { + "ds.search": { + "options": { + "queryParameters": { + "earliest": "$global_time.earliest$", + "latest": "$global_time.latest$" + } + } + } + } + } +} diff --git a/dashboards/cisco_ai_defense_threat_operations.yml b/dashboards/cisco_ai_defense_threat_operations.yml new file mode 100644 index 0000000000..a86c953ba7 --- /dev/null +++ b/dashboards/cisco_ai_defense_threat_operations.yml @@ -0,0 +1,9 @@ +name: Cisco AI Defense Threat Operations +id: 7b8213d0-61e3-46ec-9c8b-b6ab5820b849 +version: 1 +creation_date: '2026-10-18' +modification_date: '2026-10-18' +author: Nasreddine Bencherchali, Splunk +description: |- + Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections. + This dashboard uses the cisco_ai_defense macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use. From e7633b08c836c40ea8a8ce6d738c87e9c95610bf Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 19 Oct 2026 12:29:11 +0200 Subject: [PATCH 51/52] Fix AWS CreateAccessKey cross-user filter for IAMUser events (#4351) --------- Co-authored-by: Nasreddine Bencherchali --- detections/cloud/aws_createaccesskey.yml | 67 ++++++++++++++++++------ 1 file changed, 50 insertions(+), 17 deletions(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 3bf1241d2d..9b8530cbb5 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -1,28 +1,61 @@ name: AWS CreateAccessKey id: 2a9b80d3-6340-4345-11ad-212bf3d0d111 -version: 11 +version: 12 creation_date: '2021-03-02' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-19' +author: Bhavin Patel, Radka Viskova, Splunk status: production type: Hunting -description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment. +description: |- + This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. + Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. + Hunting queries are designed to be run manually during threat hunting activities. data_source: - AWS CloudTrail CreateAccessKey search: |- - `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success - | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) - | search match=0 - | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime - BY signature dest user - user_agent src vendor_account - vendor_region vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `aws_createaccesskey_filter` -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. + `cloudtrail` + eventName = CreateAccessKey + + | where (isnull(errorCode) OR errorCode="success") + AND 'userIdentity.type'="IAMUser" + AND isnotnull('userIdentity.userName') + AND isnotnull('requestParameters.userName') + AND 'userIdentity.userName'!='requestParameters.userName' + + | eval + caller_arn='userIdentity.arn', + caller_principal_id='userIdentity.principalId', + caller_user='userIdentity.userName', + dest=coalesce(dest,eventSource), + signature=coalesce(signature,eventName), + src=coalesce(src,sourceIPAddress), + target_user='requestParameters.userName', + user_agent=coalesce(user_agent,userAgent), + user_arn=coalesce(user_arn,caller_arn), + vendor_account=coalesce(vendor_account,recipientAccountId), + vendor_product=coalesce(vendor_product,"AWS"), + vendor_region=coalesce(vendor_region,awsRegion) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(dest) as dest + values(eventID) as eventIDs + values(signature) as signature + values(src) as src + values(user_agent) as user_agent + values(user_arn) as user_arn + values(vendor_product) as vendor_product + values(vendor_region) as vendor_region + + by vendor_account caller_user caller_principal_id target_user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_createaccesskey_filter` +how_to_implement: |- + You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +known_false_positives: |- + While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. references: - https://bishopfox.com/blog/privilege-escalation-in-aws - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ From 139141764d9a437fddcd8bcf86e6c90f9f28a017 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 19 Oct 2026 13:45:03 +0200 Subject: [PATCH 52/52] Revamp Cisco FTD and its Dependent Detections (#4328) --- ...tect_remote_access_software_usage_file.yml | 63 +- ..._remote_access_software_usage_fileinfo.yml | 66 +- ...t_remote_access_software_usage_process.yml | 68 +- ..._remote_access_software_usage_registry.yml | 83 +- ...___communication_over_suspicious_ports.yml | 70 +- ...ll___connection_to_file_sharing_domain.yml | 56 +- ...__remote_access_software_usage_traffic.yml | 70 +- ...etect_remote_access_software_usage_dns.yml | 49 +- ...t_remote_access_software_usage_traffic.yml | 44 +- ...http_post_request_with_encoded_payload.yml | 45 +- ...etect_remote_access_software_usage_url.yml | 49 +- lookups/csv/file_sharing_domains_lookup.csv | 103 + lookups/csv/file_sharing_domains_lookup.yml | 11 + lookups/csv/remote_access_software.csv | 3114 +++++++++++++---- lookups/csv/remote_access_software.yml | 12 +- 15 files changed, 3091 insertions(+), 812 deletions(-) create mode 100644 lookups/csv/file_sharing_domains_lookup.csv create mode 100644 lookups/csv/file_sharing_domains_lookup.yml diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 0746d33835..55f0f5265f 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,9 +1,9 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | @@ -21,31 +21,52 @@ search: | count min(_time) as firstTime, max(_time) as lastTime values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ( - "*.app", - "*.exe", - "*.msi", - "*.pkg", - "*echoware.dll", - "*Idrive.*", - "*rdp2tcp.py" - ) - by Filesystem.action Filesystem.dest Filesystem.file_access_time + + FROM datamodel=Endpoint.Filesystem WHERE + + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Filesystem.file_name + | table Filesystem.file_name + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | rename file_path as Filesystem.file_path + | table Filesystem.file_path + ] + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Filesystem)` - | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_file_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to + provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest + logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate + Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The + "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" + that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -68,11 +89,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index b7e8eb806b..30aabcc494 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,30 +1,56 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network. +description: |- + The following analytic detects the execution of processes with file or code signing attributes from known remote access software within + the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, + GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. + If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further + compromise of the network. data_source: - Sysmon EventID 1 search: |- `sysmon` EventCode=1 - | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product - BY action dest original_file_name - parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process process_exec process_guid - process_hash process_id process_integrity_level - process_name process_path user - user_id vendor_product - | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True - | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_fileinfo_filter` -how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + [ + | inputlookup remote_access_software + | search file_info!="" + | rename file_info as Product + | table Product + ] + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(Company) as Company + values(Product) as Product + + BY action dest original_file_name + parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path + process process_exec process_guid + process_hash process_id process_integrity_level + process_name process_path user + user_id vendor_product + + | lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | `remote_access_software_usage_exceptions` + + | `detect_remote_access_software_usage_fileinfo_filter` +how_to_implement: |- + This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for + Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a + KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -47,11 +73,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b579e35a22..955d943bbb 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,35 +1,63 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 18 +version: 19 creation_date: '2024-03-06' -modification_date: '2026-10-09' -author: Steven Dick, Sebastian Wurl, Splunk Community +modification_date: '2026-10-08' +author: Steven Dick, Sebastian Wurl, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. +description: |- + The following analytic detects the execution of known remote access software within the environment. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process - from datamodel=Endpoint.Processes - where - [| inputlookup remote_access_software where isutility=TRUE - | rename remote_utility AS Processes.process_name - | fields Processes.process_name] - AND Processes.dest!="unknown" - AND Processes.user!="unknown" - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(Processes.parent_process) as parent_process + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Processes.process_name + | table Processes.process_name + ] + + Processes.dest!="unknown" + Processes.user!="unknown" + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` - | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category - | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_process_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, + and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology + Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common + Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities + lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -63,11 +91,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index f000f5d3d4..11022e8877 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,17 +1,82 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 14 +version: 15 creation_date: '2024-12-28' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. +description: |- + The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. + Adversaries use these utilities to retain remote access capabilities to the environment. + Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + latest(Registry.process_guid) as process_guid + + FROM datamodel=Endpoint.Registry WHERE + + ( + Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" + OR + ( + Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" + Registry.registry_value_name="ImagePath" + ) + ) + ( + [ + | inputlookup remote_access_software + | search file_name!="" + | eval file_name="*".file_name."*" + | rex mode=sed field=file_name "s/\*\*/\*/g" + | rename file_name as Registry.registry_value_data + | table Registry.registry_value_data + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | eval file_path="*".file_path."*" + | rex mode=sed field=file_path "s/\*\*/\*/g" + | rename file_path as Registry.registry_value_data + | table Registry.registry_value_data + ] + ) + + BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + + | rex field=registry_value_data "(?i)(?:^|\\)(?[^\\\/\'\"]+\.\w{2,5})\b" + | rex field=registry_value_data "(?i)(?\w\:[\\](?:[^\\\/\'\"]+\\)+[^\\\/\'\"]+\.\w{2,5})\b" + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | `remote_access_software_usage_exceptions` + + | `detect_remote_access_software_usage_registry_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Registry` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. + The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -34,11 +99,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. - field: user type: user score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. threat_objects: - field: registry_path type: registry_path diff --git a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml index e107f64a16..3f3e554f1b 100644 --- a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml +++ b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml @@ -1,32 +1,68 @@ name: Cisco Secure Firewall - Communication Over Suspicious Ports id: d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 -version: 8 +version: 9 creation_date: '2025-04-03' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-08' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access. + The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. + It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. + Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | - `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url - | stats min(_time) as firstTime max(_time) as lastTime - values(src_port) as src_port - values(url) as url - values(rule) as rule - count by src, dest, dest_port, transport, action + `cisco_secure_firewall` + EventType=ConnectionEvent + dest_port>1024 + dest_port<49151 + + | where ( + ```Same digit ports, i.e 4444, 55555``` + ( + isint(dest_port/1111) + AND dest_port<10000 + ) + OR + isint(dest_port/11111) + + ```Ports with sequentially increasing digits, i.e 1234, 12345``` + OR + ( + isint((dest_port-123)/1111) + AND dest_port<7000 + ) + OR + isint((dest_port-1234)/11111) + + ```Ports with sequentially decreasing digits, i.e 4321``` + OR + ( + isint((dest_port+123)/1111) + AND dest_port>4000 + AND dest_port<10000 + ) + ) + + | fillnull value="unknown" url + + | stats min(_time) as firstTime + max(_time) as lastTime + values(src_port) as src_port + values(url) as url + values(rule) as rule + + count by src dest dest_port transport action + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___communication_over_suspicious_ports_filter` how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment @@ -50,7 +86,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Suspicious communication detected from $src$ to $dest$ over port $dest_port$. + message: Suspicious communication detected from [$src$] to [$dest$] over port [$dest_port$]. threat_objects: - field: url type: url diff --git a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml index d485b736f6..0f2e4a336e 100644 --- a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml +++ b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml @@ -1,35 +1,51 @@ name: Cisco Secure Firewall - Connection to File Sharing Domain id: f7e5e792-d907-46c1-a58e-4ff974dc462a -version: 10 +version: 11 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly description: | - The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S). + The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. + It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. + While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. + This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. data_source: - Cisco Secure Firewall Threat Defense Connection Event -search: | - `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") - | stats count min(_time) as firstTime max(_time) as lastTime - Values(src_port) as src_port - Values(dest) as dest - Values(dest_port) as dest_port - Values(rule) as rule - Values(url) as url - Values(EVE_Process) as EVE_Process - by src, transport, action +search: |- + `cisco_secure_firewall` + action IN ("Trust", "Allow", "allowed") + EventType=ConnectionEvent + [ + | inputlookup file_sharing_domains_lookup + | table domain + | rename domain as url + ] + + | lookup local=t file_sharing_domains_lookup domain as url OUTPUT description + + | where match(url, "(?i)\b".description."\b") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(src_port) as src_port + values(dest) as dest + values(dest_port) as dest_port + values(rule) as rule + values(url) as url + values(EVE_Process) as EVE_Process + + by src transport action + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___connection_to_file_sharing_domain_filter` how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition + with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. known_false_positives: | @@ -52,7 +68,7 @@ intermediate_findings: - field: src type: system score: 20 - message: The host $src$ initiated a connection to the file sharing or pastebin domain $url$. + message: The host [$src$] initiated a connection to a file sharing or pastebin domain [$url$]. threat_objects: - field: url type: url diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 8b32c0275e..2c00e8715b 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,48 +1,56 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 10 +version: 11 creation_date: '2025-05-28' -modification_date: '2026-09-22' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-08' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | - The following analytic detects network traffic associated with known remote access software applications - that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. +description: |- + The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event. - This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. - If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate - data, or deploy additional malware, posing a severe threat to the organization's security. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | - `cisco_secure_firewall` EventType=ConnectionEvent - | stats min(_time) as firstTime max(_time) as lastTime - values(dest_port) as dest_port - values(dest) as dest - values(transport) as transport - values(url) as url - values(rule) as rule - count by src ClientApplication action + `cisco_secure_firewall` + EventType=ConnectionEvent + + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as ClientApplication + | table ClientApplication + ] + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(dest_port) as dest_port + values(dest) as dest + values(transport) as transport + values(url) as url + values(rule) as rule + + by src ClientApplication action + + | lookup local=t remote_access_software match_pattern AS ClientApplication OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description - | search category IN ("remote administration", "remote desktop control") + | `remote_access_software_usage_exceptions` + | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` -how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. +how_to_implement: |- + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition + with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. - The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" - that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -61,7 +69,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Traffic to known remote access software [$ClientApplication$] was detected from $src$. + message: Traffic associated with known remote access software [$ClientApplication$] was detected from [$src$]. threat_objects: - field: ClientApplication type: signature diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index dc927f67a6..350fabadeb 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,35 +1,54 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly. +description: |- + The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. data_source: - Sysmon EventID 22 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Network_Resolution where - DNS.query=* - NOT DNS.query IN ("-", "unknown") - by DNS.answer DNS.answer_count DNS.query + + FROM datamodel=Network_Resolution WHERE + + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as DNS.query + | table DNS.query + ] + + BY DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product + | `drop_dm_object_name("DNS")` + + | lookup local=t remote_access_software domain AS query OUTPUT app as signature, category, reference, description + | eval dest = query + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, - comment_reference as desc, category - | eval dest = query - | search isutility = True + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_dns_filter` -how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + To implement this search, you must ingest logs that contain the DNS query and the source of the query. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. + The logs must also be mapped to the `Network_Resolution` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. + The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with + any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv + lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -52,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $query$ was contacted by $src$. + message: A domain [$query$] for a known remote access software [$signature$] was contacted by [$src$]. threat_objects: - field: query type: domain diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index f088392075..ae4856160e 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,15 +1,14 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. - If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. data_source: - Palo Alto Network Traffic search: | @@ -18,24 +17,39 @@ search: | max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(All_Traffic.user) as user - from datamodel=Network_Traffic where - All_Traffic.app=* - NOT All_Traffic.app IN ("-", "unknown") - by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in + + FROM datamodel=Network_Traffic + WHERE + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as All_Traffic.app + | table All_Traffic.app + ] + + BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` + + | lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` -how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro + leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain + device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -59,11 +73,11 @@ intermediate_findings: - field: src type: system score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. - field: user type: user score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. threat_objects: - field: signature type: signature diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml index f05fb1a082..61d787aa4d 100644 --- a/detections/network/http_post_request_with_encoded_payload.yml +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -2,14 +2,14 @@ name: HTTP POST Request with Encoded Payload id: 0590881d-7b81-48dd-9674-1f23f7db5d40 version: 1 creation_date: '2026-10-12' -modification_date: '2026-10-12' -author: Raven Tait, Splunk +modification_date: '2026-10-13' +author: Raven Tait, Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: |- - The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. - It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. - This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. data_source: - Zeek HTTP search: |- @@ -17,23 +17,37 @@ search: |- method="POST" post_body="*" - | eval dest_port=coalesce(dest_port, 'id.resp_p'), - dest=coalesce(dest, dest_ip, 'id.resp_h'), - src=coalesce(src, src_ip, 'id.orig_h') + NOT orig_mime_type_first_stated IN ( + "application/x-www-form-urlencoded", + "application/ocsp-request" + ) + + NOT user_agent IN ( + "MicroMessenger Client", + "Dalvik*", + "AliPayWallet*" + ) - | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) - | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') - | where _hex=1 OR _b64=1 + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\u[A-Fa-f0-9]{4}|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ") - | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + | where encoding!="" | stats count min(_time) as firstTime max(_time) as lastTime - values(encoding_type) as encoding_type + values(uri) as uri + values(encoding) as encoding values(post_body) as post_body - by src dest dest_port uri method status_code + by src dest dest_port method status_code | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -49,6 +63,7 @@ references: - https://attack.mitre.org/techniques/T1071/001/ - https://attack.mitre.org/techniques/T1132/001/ - https://docs.zeek.org/en/master/logs/http.html + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md drilldown_searches: - name: View the detection results for - "$src$" search: '%original_detection_search% | search src = "$src$"' @@ -63,7 +78,7 @@ intermediate_findings: - field: src type: system score: 20 - message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. + message: An HTTP POST request with an encoded body of type [$encoding$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. threat_objects: - field: uri type: uri diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 228dd2e6a2..74856edc8c 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,18 +1,17 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. - This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk. data_source: - Palo Alto Network Threat -search: | +search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime @@ -22,28 +21,42 @@ search: | latest(Web.user) as user latest(Web.dest) as dest - from datamodel=Web where + FROM datamodel=Web WHERE Web.url_domain=* NOT Web.url_domain IN ( - "-", - "unknown" + "-", + "unknown" ) - by Web.action Web.src Web.category + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as Web.url_domain + | table Web.url_domain + ] + + BY Web.action Web.src Web.category Web.url_domain Web.url_length + | `drop_dm_object_name("Web")` + + | lookup local=t remote_access_software domain AS url_domain OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name("Web")` - | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference - as desc, category - | search isutility = True + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_url_filter` how_to_implement: | - The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. + The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well + as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -66,11 +79,11 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. - field: user type: user score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. threat_objects: - field: signature type: signature diff --git a/lookups/csv/file_sharing_domains_lookup.csv b/lookups/csv/file_sharing_domains_lookup.csv new file mode 100644 index 0000000000..cda6d83921 --- /dev/null +++ b/lookups/csv/file_sharing_domains_lookup.csv @@ -0,0 +1,103 @@ +domain,description +*0bin.net*,0bin.net +*1ty.me*,1ty.me +*235523.xyz*,235523.xyz +*8n1.org*,8n1.org +*99paste.com*,99paste.com +*anonfiles.com*,anonfiles.com +*apaste.info*,apaste.info +*beanpaste.fun*,beanpaste.fun +*bin.bloerg.net*,bin.bloerg.net +*bin.jarkon.fi*,bin.jarkon.fi +*bin.lysator.liu.se*,bin.lysator.liu.se +*bpa.st*,bpa.st +*cl1p.net*,cl1p.net +*clbin.com*,clbin.com +*codebeautify.org*,codebeautify.org +*codeshare.io*,codeshare.io +*commie.io*,commie.io +*controlc.com*,controlc.com +*crypticbin.com*,crypticbin.com +*cutapaste.net*,cutapaste.net +*defuse.ca*,defuse.ca +*dotnetfiddle.net*,dotnetfiddle.net +*dpaste.com*,dpaste.com +*everfall.com*,everfall.com +*filebin.net*,filebin.net +*fragbin.com*,fragbin.com +*friendpaste.com*,friendpaste.com +*ghostbin.co*,ghostbin.co +*gistpad.com*,gistpad.com +*glitch.me*,glitch.me +*gofile.io*,gofile.io +*hastebin.com*,hastebin.com +*hastebin.dev*,hastebin.dev +*ideone.com*,ideone.com +*ivpaste.com*,ivpaste.com +*jaw.gg*,jaw.gg +*jpst.it*,jpst.it +*jsbin.com*,jsbin.com +*jsfiddle.net*,jsfiddle.net +*jsitor.com*,jsitor.com +*justpaste.it*,justpaste.it +*justpaste.me*,justpaste.me +*kpaste.net*,kpaste.net +*lesma.eu*,lesma.eu +*mediafire.com*,mediafire.com +*mega.nz*,mega.nz +*modernpaste.com*,modernpaste.com +*n0paste.tk*,n0paste.tk +*nekobin.com*,nekobin.com +*nopaste.net*,nopaste.net +*notes.io*,notes.io +*p.ip.fi*,p.ip.fi +*paste-bin.xyz*,paste-bin.xyz +*paste.ax*,paste.ax +*paste.centos.org*,paste.centos.org +*paste.debian.net*,paste.debian.net +*paste.ee*,paste.ee +*paste.jp*,paste.jp +*paste.js.org*,paste.js.org +*paste.monster*,paste.monster +*paste.myst.rs*,paste.myst.rs +*paste.ofcode.org*,paste.ofcode.org +*paste.opensuse.org*,paste.opensuse.org +*paste.org.ru*,paste.org.ru +*paste.rohitab.com*,paste.rohitab.com +*paste.sh*,paste.sh +*paste.strictfp.com*,paste.strictfp.com +*paste2.org*,paste2.org +*pastebin*,pastebin +*pastecn.com*,pastecn.com +*pastecode.io*,pastecode.io +*pastecode.ru*,pastecode.ru +*pasted.co*,pasted.co +*pastee.dev*,pastee.dev +*pastejustit.com*,pastejustit.com +*pastelink.net*,pastelink.net +*pastes.io*,pastes.io +*pastesio.com*,pastesio.com +*pastetext.net*,pastetext.net +*pastey.gg*,pastey.gg +*pastie.org*,pastie.org +*primenotepad.com*,primenotepad.com +*privatebin.net*,privatebin.net +*privatlab*,privatlab +*privnote.com*,privnote.com +*quickhighlighter.com*,quickhighlighter.com +*rentry.co*,rentry.co +*send.exploit.in*,send.exploit.in +*sendspace.com*,sendspace.com +*snippet.host*,snippet.host +*storjshare.io*,storjshare.io +*temp.sh*,temp.sh +*termbin.com*,termbin.com +*textbin.net*,textbin.net +*tny.cz*,tny.cz +*transfer.sh*,transfer.sh +*tutpaste.com*,tutpaste.com +*ufile.io,ufile.io +*vpaste.net*,vpaste.net +*xi.pe*,xi.pe +*zerobin.net*,zerobin.net +*zigbin.io*,zigbin.io \ No newline at end of file diff --git a/lookups/csv/file_sharing_domains_lookup.yml b/lookups/csv/file_sharing_domains_lookup.yml new file mode 100644 index 0000000000..7d199cea23 --- /dev/null +++ b/lookups/csv/file_sharing_domains_lookup.yml @@ -0,0 +1,11 @@ +name: file_sharing_domains_lookup +id: 325e53a9-50be-4b00-be34-7925063b4278 +version: 1 +creation_date: '2019-10-06' +modification_date: '2026-10-06' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of file sharing domains and pastebin-style hosting domains that can be modified +match_type: + - WILDCARD(domain) +case_sensitive_match: false diff --git a/lookups/csv/remote_access_software.csv b/lookups/csv/remote_access_software.csv index f8b8619427..632afe450c 100644 --- a/lookups/csv/remote_access_software.csv +++ b/lookups/csv/remote_access_software.csv @@ -1,606 +1,2508 @@ -description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update -Absolute (Computrace),*search.namequery.com,rpcnet.exe,Absolute Software*,absolute-manage,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),*server.absolute.com,ctes.exe,Absolute Persistence*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,ctespersitence.exe,CTES*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,cteshostsvc.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,rpcld.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024 -Microsoft Quick Assist,remoteassistance.support.services.microsoft.com*,quickassist.exe,Quick Assist,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024 -MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024 -MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.beanywhere.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024 -NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024 -NinjaRMM,*.ninjarmm.com,NinjaRMMAgentPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,4/4/2025 -NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -NoMachine,,nxservice*.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,4/4/2025 -NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024 -Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024 -Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024 -Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,csexec.exe,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024 -PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024 -RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024 -rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024 -Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024 -RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024 -RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024 -RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024 -247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024 -Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024 -HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024 -HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024 -Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024 -Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024 -Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024 -Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024 -Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024 -Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024 -Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024 -Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024 -Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -AnyDesk,*net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024 -AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024 -BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeAnyWhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024 -Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024 -Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024 -Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024 -Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024 -Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024 -EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024 -Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024 -Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_launcher.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_display.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024 -DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024 -NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024 -OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024 -Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024 -Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024 -VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024 -WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024 -Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024 -ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,zoho-assist,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.eu,zaservice.exe,,zoho-assist-base,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Syncro,app.kabuto.io,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Devolutions Remote Desktop Manager,*cloud.devolutions.net,RemoteDesktopManager*.exe,Devolutions inc,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*api.devolutions.com,Devolutions.Updater.exe,Remote Desktop Manager,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*telemetry2.devolutions.net,,,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Koofr,*app.koofr.net,storagegui.exe,koofr*,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -Koofr,,storagechrome.exe,,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -MEGA Sync,*mega.co.nz,MEGAsyncSetup*.exe,MEGA Limited,mega-base,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*api.mega.co.nz,Megasync.exe,MEGAsync,mega-chat,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*mega.nz,MegaUpdater.exe,,,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -NordLocker,*cloud.nordlocker.com,nordlockersetup*.exe,nordvpn*,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*.nordcdn.com,NordLocker.exe,NordLocker,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*auth.nordlocker.com,NordUpdateService.exe,NordSec Update Service,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -Total Software Deployment,*.softinventive.com,tsd-setup.exe,SoftInventive Lab,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Total Software Deployment,,tsd.exe,Total Software Deployment,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Yandex Disk,*disk.yandex.run,YandexDisk*Setup.exe,Yandex LLC,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*cloud-api.yandex.net,YandexDisk2.exe,Yandex.Disk,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*yastatic.net,YandexNotes.exe,Yandex,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,passport.yandex.com,,,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Glance,screenshare-location.glance.net,GlanceSetup*.exe,GlanceClient*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,s*.glance.net,GlanceGuestSetup*.exe,GlanceLauncher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,pr*.glance.net,Glance.exe,Glance Setup*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GlanceLauncher.exe,Glance Launcher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GProtocolHandler.exe,Glance Networks*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Microsoft SCCM Remote Control,user_managed,sccmrdpsystem.exe,SCCM RDP System,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,sccmrdpuser.exe,Microsoft Configuration Manager Remote Control,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcservice.exe,Configuration Manager Remote Control Service,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcviewer.exe,ConfigMgr Remote Control Viewer,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -NexThink,*.data.us.nexthink.cloud,nxtsvc.exe,Nexthink Collector*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.eu.nexthink.cloud,nxtcod.exe,Nexthink Coordinator*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.pac.nexthink.cloud,nxtcoordinator.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.meta.nexthink.cloud,nxtupdater.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 +app,"match_pattern",domain,"file_path","file_name","file_info",category,reference,description +"247ithelp.com (ConnectWise)","247ithelp.com*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)","ConnectWise*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,"*.247ithelp.com",,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,,,"Remote Workforce Client.exe",,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Absolute*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Computrace*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctes.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"cteshostsvc.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctespersistence.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcld.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcnet.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Persistence*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"CTES*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Software*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","Access Remote PC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","AccessRemotePC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC",,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Acronis Cyber Protect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","AcronisCyberProtect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Remotix*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"agents*-cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"connect.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"gw.remotix.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectAgent.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectQuickAssist*.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Agent",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Quick Assist",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Action1,"Action1*",,,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"*.action1.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"a1-backend-packages.s3.amazonaws.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,"C:\Windows\Action1\*",,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,,,"Action1*",RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Addigy,"Addigy*",,,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"agents.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"grtmprod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"prod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,"addigy-*.pkg",,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,,"Addigy*",RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,"AeroAdmin*",,,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"auth*.aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"AeroAdmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"aeroadmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"Aero Admin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"AeroAdmin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control","AliWangWang-remote-control*",,,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,"wangwang.taobao.com",,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,"alitask.exe",,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,,"AliWangWang*",RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Allocentra,"Allocentra*",,,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,"api.allocentra.co.za",,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,"C:\Program Files\Allocentra\Agent\allocentra-agent.exe",,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,,"allocentra-agent.exe",,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Alpemix,"Alpemix*",,,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.alpemix.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.teknopars.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixService.exe",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixSrvc\",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Teknopars*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Alpemix*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","Any Support*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","AnySupport*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,"*.anysupport.net",,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,"ManualLauncher.exe",,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Koino Co.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Ltd.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"AnySupport*",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyDesk,"AnyDesk*",,,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"boot.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"relay-*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"/Applications/AnyDesk.app",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\AnyDesk.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"philandro Software*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"anydesk*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyViewer,"AnyViewer*",,,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.anyviewer.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.aomeisoftware.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,"C:\Program Files (x86)\AnyViewer\*",,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"Anyviewer*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"AOMEI*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","Anyplace Control*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","AnyplaceControl*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,"anyplace-control.com",,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,"apc_host.exe",,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,,"Anyplace*",RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Aspia,"Aspia*",,,,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"*\aspia_client.exe",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files (x86)\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Atera,"Atera*",,,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agent-api.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agenthb.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreporting.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreportingstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"app.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"appcdn.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera-agent-heartbeat.servicebus.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera.pubnubapi.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"getalphacontrol.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"packagesstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"ps.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"pubsub.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageNetworkDiscovery.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageTaskScheduler.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AteraAgent.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files (x86)\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"atera_agent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"ateraagent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"syncrosetup.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,AteraAgent,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,"Atera Networks",RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Auvik,"Auvik*",,,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.my.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.agent.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.engine.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,"AweRay*",,,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"asapi*.aweray.net",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"client-api.aweray.com",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"AweSun.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"aweray_remote*.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweSun*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweRay*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,"Barracuda*",,,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"*.islonline.net",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"rmm.barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda Networks",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"LPI Level Platforms",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda MSP",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,"Basecamp*",,,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,,"basecamp.com",,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Basic RMM Agent","Basic RMM Agent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +"Basic RMM Agent","BasicRMMAgent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +BeAnyWhere,"BeAnyWhere*",,,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,"beanywhere.com",,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupApp.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppElev.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppSrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupSysInf.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"TakeControl.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvcupdate.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basuptshelper.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,"BeInSync*",,,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.com",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.net",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,"Beinsync*.exe",,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,"BeInSync Client GUI",RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,BeInSync,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Beacon (Synertek)","Beacon*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)","Synertek*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/LaunchDaemons/com.beacon.agent.plist",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/systemd/system/beacon-agent.service",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/usr/local/bin/beacon-agent",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/var/log/beacon-agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\Program Files\Beacon\beacon-agent.exe",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BeamYourScreen,"BeamYourScreen*",,,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"*.beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen-host.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,,"BeamYourScreen*",RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeyondTrust,"BeyondTrust*",,,,,RMM,"","BeyondTrust is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","BeyondTrust*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","Bomgar*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.beyondtrustcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-rdp.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"Bomgar*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"BeyondTrust*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BlackCrypt RMM Agent","BlackCrypt RMM Agent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent","BlackCryptRMMAgent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent",,"blackcryptknight.com",,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +Borealis,"Borealis*",,,,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-updater.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-watchdog.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Agent",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Logs/Agent/agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\*",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\Logs\Agent\agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BreezeRMM,"BreezeRMM*",,,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breezermm.com",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"eu.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"us.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Application Support/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-loginwindow.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-user.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.agent.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.watchdog.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Logs/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/systemd/system/breeze-agent.service",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-agent",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-backup",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-desktop-helper",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-watchdog",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/lib/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/log/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\Program Files\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\ProgramData\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,,"PixoIT-agent.exe",,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +"CHAOS RAT","CHAOS RAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CHAOS RAT","CHAOSRAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CentraStage (Datto)","CentraStage*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)","Datto*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.rmm.datto.com",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"AEMAgent.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"CagService.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,,"Datto*",RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,"Centurion*",,,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,"centuriontech.com",,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,,,"ctiserv.exe",,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chicken (of the VNC)","Chicken*",,,,,RAT,"https://github.com/flit/cotvnc","Chicken (of the VNC) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome Remote Desktop","Chrome Remote Desktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop","ChromeRemoteDesktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-client.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-host.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-oauth.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\remoting_host.exe",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"C:\Program Files (x86)\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,"remoting_host.exe",,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,,"Chrome Remote Desktop",RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome SSH Extension","Chrome SSH Extension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension","ChromeSSHExtension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"*Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CloudFlare Tunnel","CloudFlare Tunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel","CloudFlareTunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.cfargotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.trycloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"_v2-origintunneld._tcp.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"api.cloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"h2.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"quic.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"update.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files (x86)\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,,"cloudflared.exe",,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"Comodo RMM","Comodo RMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM","ComodoRMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"one.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"itsmagent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"rviewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,"ConnectWise*",,,,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"*\ScreenConnect*Client*\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ScreenConnect*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ConnectWise*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWise Control*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWiseControl*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"control.connectwise.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"live.screenconnect.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisechat-customer.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisecontrol.client.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"screenconnect.windowsclient.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ScreenConnect*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ConnectWise*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","Connectwise Automate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","ConnectwiseAutomate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","LabTech*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,"*.hostedrmm.com",,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvc.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvcmon.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"lttray.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ControlR,"ControlR*",,,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,"demo.controlr.app",,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.*.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Library/Application Support/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/usr/local/bin/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\ControlR.Agent.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.dll",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\ProgramData\ControlR\",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +Controlio,"Controlio*",,,,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,"C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\",,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"bbl.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"libeay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"ssleay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weCliboardListener.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weInstSvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.pkg",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wemonc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weprtct.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wesvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +CrossLoop,"CrossLoop*",,,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"*.crossloop.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"crossloop.en.softonic.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"CrossLoopConnect.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"WinVNCStub.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"crossloopservice.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,,"Crossloop*",RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CrossTec Remote Control","CrossTec Remote Control*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control","CrossTecRemoteControl*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"PCIVIDEO.EXE",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"supporttool.exe",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,,CrossTec,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +CruzControl,"CruzControl*",,,,,RMM,"https://resources.doradosoftware.com/cruz-rmm","CruzControl is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DW Service*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DWService*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,"*.dwservice.net",,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagent.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwaglnc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagsvc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,,"DWSNET*",RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,"DameWare*",,,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,"dameware.com",,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcst.exe",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Program Files\SolarWinds\Dameware Mini Remote Control\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Windows\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Mini Remote Control*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Remote Support.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-DRS*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-MRC*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dntus*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dwrcs.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,,"DameWare*",RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Dataplicity,"Dataplicity*",,,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.wormhole.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"www.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/init.d/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/systemd/system/dataplicity.service",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/tuxtunnel/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/usr/local/bin/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +DeskDay,"DeskDay*",,,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"app.deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,,,"ultimate_*.exe",,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskNets,"DeskNets*",,,,,RMM,"https://www.desknets.com/en/download.html","DeskNets is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,"DeskShare*",,,,,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"DSGuest.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"TeamTaskManager.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"DeskShare*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"Team Task Manager*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,"DesktopNow*",,,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,"*.nchuser.com",,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,"desktopnow.exe",,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"NCH Software*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"DesktopNow*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","Dev Tunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","DevTunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","aka Visual Studio Dev Tunnel*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","Devolutions Remote Desktop Manager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","DevolutionsRemoteDesktopManager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"*\RemoteDesktopManager.exe",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"C:\Program Files\Devolutions\Remote Desktop Manager",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Remote Desktop Manager",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Devolutions inc",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","Distant Desktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","DistantDesktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.distantdesktop.com",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"dd.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"ddsystem.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"distant-desktop.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Desktop*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"German Gorodokuplya*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Software*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,"Domotz*",,,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.domotz.co",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App Setup*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz-windows*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz_bash.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,,"Domotz*",RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,"DragonDisk*",,,,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\DragonDisk.exe",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"C:\Program Files (x86)\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Duet Display","Duet Display*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display","DuetDisplay*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"rdp.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetDisp.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetSetup.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"duet.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +Duplicati,"Duplicati*",,,,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"*\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"c:\Program Files\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCO Remote Console*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCORemoteConsole*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,"emcosoftware.com",,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,,,"remoteconsole.exe",,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESET Remote Administrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESETRemoteAdministrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ERAAgent.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"einstaller.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"era.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"eratool.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ezhelp*.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,,"ESET Management*",RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,"Echoware*",,,,,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoserver*.exe",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoware.dll",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","Electric AI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","ElectricAI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)",,"electric.ai",,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,"Encapto*",,,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,,"encapto.com",,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Endar,"Endar*",,,,,RMM,"https://github.com/tomkeene/endar,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/README.md,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/app/agent_api_v1/views.py,https://github.com/tomkeene/endar/releases/tag/1.0.0,https://github.com/tomkeene/endar/releases/download/1.0.0/endar.exe","Endar is an open-source, self-hosted RMM platform focused on endpoint monitoring and compliance policies. Its controller source exposes agent registration, policy retrieval, compliance-result, and data-collection endpoints. Static extraction of the sole GitHub 1.0.0 release asset identifies a Linux x86-64 PyInstaller endpoint agent with registration, policy, data-collection, and compliance-task code. The source for that agent is not in the repository, and the asset does not establish a default installation directory or service; this entry records only supported release evidence." +"Ericom AccessNow","Ericom AccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow","EricomAccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","Ericom Connect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","EricomConnect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"EricomConnectRemoteHost*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"ericomconnectconfigurationtool.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,"ExtraPuTTY*",,,,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"C:\Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Faronics Core","Faronics Core*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core","FaronicsCore*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\CoreAgentService.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\FaronicsCoreAgent.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files (x86)\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Core\Console\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\Workstation Agent\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\ProgramData\Faronics\FCAForStartupMonitor.msi",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"CoreAgentService.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"FaronicsCoreAgent.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","Faronics Deep Freeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","FaronicsDeepFreeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"cloud.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFC.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServ.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServEx.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFWks.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-1\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics Corporation\Deep Freeze 7.00\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFC.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFInst.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServ.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServEx.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStd.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStdInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFWks.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deploy","Faronics Deploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy","FaronicsDeploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"1wuccjc4a3.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"29qoj3q0yf.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"deploy.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"nv0mddxkh7.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ap-southeast-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ca-central-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-eu-west-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-sa-east-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-east-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-west-2.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"www.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\ProgramData\Faronics\StorageSpace\FWA\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAService.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAWebInstaller_*.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWA_UI_Agent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FaronicsDeployAgent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Insight","Faronics Insight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight","FaronicsInsight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentAgent.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentSvc.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentUI.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Teacher\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentAgent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentUI.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstaller.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerStudent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerTeacher.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightSetup.msi",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"STAHelper.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"StudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +FastViewer,"FastViewer*",,,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"*.fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"FastViewer.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastclient.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastmaster.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,,"Fastviewer*",RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it","FixMe.it*",,,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.techinline.net",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,9380CC75B872221A7425D7503565B67580407F60,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Client.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Expert Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Unattended Access Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeitClient*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientHelper*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertStandalone.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"fixmeitclient.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe.IT Helper",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"SetMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FleetDeck.io","FleetDeck.io*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"*.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"agentmqtt.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"checkip.zmazonaws.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Windows\Temp\FleetDeck\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.mst",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_launcher.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_installer.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,,"FleetDeck*",RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +Fortra,"Fortra*",,,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Fortra,,"fortra.com",,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","Free Ping Tool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","FreePingTool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool",,,,"can't find this one",,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","Free Tools Launcher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","FreeToolsLauncher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"*\ManageEngine\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,"FreeNX*",,,,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"C:\*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Freshservice,"Freshservice*",,,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshcloud.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshconnect.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworksapi.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.in-freshbots.ai",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.myfreshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.rtschannel.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.webpush.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"api.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"apicdn-wchat.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"static.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"www.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSWmiScanner.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\plink.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\db\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\nmap\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\tools\ssh\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"FSAgent.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-probe-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-windows-agent-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"win-installer-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +"GLPI Agent","GLPI Agent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent","GLPIAgent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"forum.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"nightly.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"services.glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"www.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/etc/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/etc/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/local/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/var/lib/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\etc\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\logs\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\perl\bin\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\var\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GO RMM","GO RMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GO RMM","GORMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GatherPlace-desktop sharing","GatherPlace-desktop sharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing","GatherPlace-desktopsharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.net",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp3.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp4.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp5.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,,"Gatherworks*",RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GetScreen,"GetScreen*",,,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"GetScreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"go.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"image.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"px-*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Program Files\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\ProgramData\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\AppData\Local\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen-x86.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen.upd.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"Point B Ltd*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"getscreen.me*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +"Go Mini RMM","Go Mini RMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"Go Mini RMM","GoMiniRMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"GoTo Opener","GoTo Opener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener","GoToOpener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"*\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"C:\Program Files (x86)\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,"GoToAssist*",,,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.cdn.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.desktopstreaming.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.fastsupport.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.at",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.me",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"goto.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"helpme.net",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"GoTo Assist Opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2a*.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2ax_comm_customer.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mcomm.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mupdate.com",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"goto opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"gotoassist.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,,"GoToAssist*",RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist (GoTo Resolve)","GoTo Resolve*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)","GoToAssist*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files (x86)\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveExternalModuleHandler.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveFileManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveLoggerProcess.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveNetworkChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveProcessChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveQuickView.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRegistryEditor.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRemoteControl.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveService.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveServiceManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTerminal.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools32.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools64.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattended.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedRemover.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,,"GoToAssist*",RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist Agent Desktop Console","GoToAssist Agent Desktop Console*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console","GoToAssistAgentDesktopConsole*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"C:\*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,"GoToMyPC*",,,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,"*.GoToMyPC.com",,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"%APPDATA%\GoToMeeting\G2M.exe",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"C:\Program Files (x86)\GoToMyPC\*",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,"G2M.exe",,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,GoToOpener,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,"GoTo Opener",RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Gorelo RMM","Gorelo RMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM","GoreloRMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"app.gorelo.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gorelo-rmm.azurewebsites.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gw.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"lr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"public.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"r1.rmm.uw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"sr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +GotoHTTP,"GotoHTTP*",,,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"*.gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP*.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP_x64.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"gotohttp.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"Pingbo*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"GotoHTTP*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,"Goverlan*",,,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,"goverlan.com",,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\GovSrv.exe",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"C:\Program Files (x86)\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentInstallHelper.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentx64.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovReachClient.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"goverrmc.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"govsrv*.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,,"Goverlan*",RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,"Guacamole*",,,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,"guacamole.apache.org",,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,,,"guacd.exe",,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GxM RMM Agent","GxM RMM Agent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent","GxMRMMAgent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\agent\GxM.Agent.exe",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\enrollment.json",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\install.log",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"C:\GxM\agent",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +HeartbeatRM,"HeartbeatRM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"*.heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"*\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files (x86)\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"agent-installer-any.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-updater-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HelpBeam,"HelpBeam*",,,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,"helpbeam.software.informer.com",,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,,,"helpbeam*.exe",,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,"HelpU*",,,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"*.helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuManager.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuUpdater.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"helpu_install.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"Help Manager Program",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"helpU*",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpWire,"HelpWire*",,,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"account.flexihub.com",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"api.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"get.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"staging.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stun.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stunserver.stunprotocol.org",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/Applications/HelpWire Operator.app",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/lib/systemd/system/helpwire-unattended.service",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"helpwire-operator/bin/helpwire-operator",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Quick.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Unattended Access.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"helpwire.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HopToDesk,"HopToDesk*",,,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"api.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"download.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"signal.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"turn.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"www.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,"C:\Program Files (x86)\HopToDesk\HopToDesk.exe",,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk-Standalone.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +"I'm InTouch","I'm InTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch","I'mInTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,"*.01com.com",,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"I'm InTouch Go Installer.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"iit.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"intouch.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,,"I'm InTouch*",RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISL Light*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISLLight*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,"islonline.com",,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"islalwaysonmonitor.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllight.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllightservice.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISL Online*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISLOnline*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.com",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.net",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISLLight.exe",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"C:\Program Files (x86)\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLightClient.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"islalwaysonmonitor.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllightservice.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Light*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Online*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IT Agent","IT Agent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent","ITAgent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSender.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderSL.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderUpdater.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentSender.aiui",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"ITSupport247 (ConnectWise)","ConnectWise*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)","ITSupport247*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"*.itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,,,"saazapsc.exe",,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ImmyBot,"ImmyBot*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"*.immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"*\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Windows\Temp\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyAgent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.Agent.Ephemeral.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyUpdater.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +"Impero Connect","Impero Connect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect","ImperoConnect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,"imperosoftware.com",,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,,,"ImperoClientSVC.exe",,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","Instant Housecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","InstantHousecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.net",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"secure.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"InstantHousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"hsloader.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"ihcserver.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"instanthousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,"Insync*",,,,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*Users\*\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"C:\Users\USERNAME\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdmin Remote Control*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdminRemoteControl*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,"*.intelliadmin.com",,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent32.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent64.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent_setup_5.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"iadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"intelliadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +InvGate,"InvGate*",,,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"*.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"docs.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"help.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-info.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-list.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"lb-insight-001.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"releases.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust-access.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"www.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\*",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\DepHlp.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\InvGate-ED.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\Software Matt.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateAssetsRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\sas.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +"Iperius Remote","Iperius Remote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote","IperiusRemote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius-rs.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperius.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperiusremote.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter S.R.L*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Iperius Remote*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter Srl*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,"Itarian*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.cmdm.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"remoteaccess.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"servicedesk.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ComodoRemoteControl.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMAgent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITarianRemoteAccessSetup.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ItsmRsp.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RAccess.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RDesktop.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RHost.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RViewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RmmService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"RMM*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"Itarian*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","Ivanti Remote Control*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","IvantiRemoteControl*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,"*.ivanticloud.com",,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"AgentlessRC.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"ArcUI.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"IvantiRemoteControl.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +JollysFastVNC,"JollysFastVNC*",,,,,RAT,"","JollysFastVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","Jump Cloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","JumpCloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.api.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.assist.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,"JumpCloud*.exe",,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,,"JumpCloud*",RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","Jump Desktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","JumpDesktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpclient.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpconnect.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpdesktop.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpservice.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpupdater.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,"KHelpDesk*",,,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,"*.khelpdesk.com.br",,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,"KHelpDesk.exe",,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"Ferramenta de Acesso Remoto",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"KHELPDESK*",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,"Kabuto*",,,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,"*.kabuto.io",,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,,,"Kabuto.App.Runner.exe",,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,"KiTTY*",,,,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"C:\*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,"KickIdler*",,,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"my.kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberEM.*msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberTT*.msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Komari,"Komari*",,,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"ghcr.io",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"github.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"komari-document.pages.dev",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"raw.githubusercontent.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"www.komari.wiki",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari-agent.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/opt/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/usr/local/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\Program Files\Komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Koofr,"Koofr*",,,,,RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Koofr,,,,,"koofr*",RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,"LANDesk*",,,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanticloud.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\issuser.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\softmon.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\tmcsvc.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"C:\Program Files (x86)\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"LANDeskPortalManager.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"issuser.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"landeskagentbootstrap.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldinv32.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldsensors.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LS RMM","LS RMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM","LSRMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"webserv.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"www.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM Worker.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM Worker.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LabTeach (Connectwise Automate)","Connectwise Automate*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)","LabTeach*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)",,,,"ltsvc.exe",,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","ConnectWise Automate*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech RMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTechRMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,"connectwise.com",,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvc.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvcmon.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"lttray.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","Laplink Everywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","LaplinkEverywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"atled.syspectr.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"everywhere.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"le.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"OOSysAgent.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink-everywhere-setup*.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplinkeverywhere.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"llrcservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"serverproxyservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","Laplink Gold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","LaplinkGold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"laplink.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"tsircusr.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lavawall,"Lavawall*",,,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"api-ca-1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"caremote1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"lavawinupdate.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files (x86)\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Level,"Level*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"agents.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"builds.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"downloads.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"online.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,,"C:\Program Files\Level\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +"Level.io","Level.io*",,,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"*.level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-remote-control-ffmpeg.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-windows-amd64.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,,"Level*",RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LightRmmAgent,"LightRmmAgent*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,"light-rmm-monitor-20260825.azurewebsites.net",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,,"C:\Program Files\LightRmmAgent\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +"Lite Manager","Lite Manager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager","LiteManager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LMNoIpServer.exe",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"C:\Program Files\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"LiteManager*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMServer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMViewer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"Yakhnovets Denis*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,"LiteManager*",,,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.ru",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMFUSClient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMServer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"lmnoipserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romfusclient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romviewer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"LiteManager*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMServer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMViewer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"Yakhnovets Denis*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LocalXpose,"LocalXpose*",,,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"*.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"api.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"%APPDATA%\loclx\*",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"*\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"/usr/local/bin/loclx",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"C:\Users\*\AppData\Local\Programs\loclx\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,loclx,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,"loclx.exe",,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LogMeIn,"LogMeIn*",,,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.eu",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmeininc.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmein-gateway.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmeinrescue.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"RemotelyAnywhere*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"LogMeIn*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeIn rescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeInrescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.eu",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-data-cetner.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-list.*.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue_srv.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"lmi_rescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue*.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lunixar,"Lunixar*",,,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"*.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"app.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"devrmm.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"downloads.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"mymeetinggoogle.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"socket.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.Agent.Core.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"C:\Program Files\Lunixar\*",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"Googlemeet.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"LunixarRMM*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"eDocument-*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +MEGAsync,"MEGAsync*",,,,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*ProgramData\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAsyncSetup64.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAupdater.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"C:\Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,MEGAsync,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,"MEGA Limited",RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,"MSP360*",,,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.cloudberrylab.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.mspbackups.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CBBackupPlan.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.RM.Service.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.Scheduler.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaCmd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaSd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaService.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaUtilities.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Connect.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Online Backup.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"RMM.Agent.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Remote Desktop.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"cbb.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"Cloud.Ra*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"MSP360*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Desktop Central*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Manage Engine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","ManageEngine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.-dms.zoho.com.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentregister.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentservice.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngine RMM Central*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngineRMMCentral*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine ServiceDesk Plus","ManageEngine ServiceDesk Plus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus","ManageEngineServiceDeskPlus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"*.manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files (x86)\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.bin",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +MeshCentral,"MeshCentral*",,,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,"meshcentral.com",,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshagent*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshcentral*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,,meshcentral,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +"Microsoft Quick Assist","Microsoft Quick Assist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist","MicrosoftQuickAssist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,"quickassist.exe",,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,,"Quick Assist",RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,"Mikogo*",,,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo4.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.real-time-collaboration.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Screen-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"C:\Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-service.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-starter.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogolauncher.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Minexus,"Minexus*",,,,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +Minexus,,,"/etc/systemd/system/minion.service",,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +"Mini RMM Agent","Mini RMM Agent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent","MiniRMMAgent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\Program Files\MiniRMM\MiniRmmAgent.exe",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\Invoke-AVExclusions.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\SmartScreenTest.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"MioNet (Also known as WD Anywhere Access)","Also known as WD Anywhere Access*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)","MioNet*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionet.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","MioNet*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","WD Anywhere Access*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionet.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Miradore,"Miradore*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"*.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gateway.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gerwconline.blob.core.windows.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"*\Miradore\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"C:\Program Files\Miradore\OnlineClient\bin\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +"Mocha VNC Lite","Mocha VNC Lite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite","MochaVNCLite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,"*\RealVNC\VNC4\*",,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,,"This installs a modified VNC and cannot be blocked by path separate from VNC",,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Monitic,"Monitic*",,,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"api.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"app.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"devapi.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"turn.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"www.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\*",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\agent.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\amon.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\conf.json",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +"Mouse Without Borders","Mouse Without Borders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders","MouseWithoutBorders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders",,,"C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\*",,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +MultCloud,"MultCloud*",,,,,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MultCloud,,,,"requires sign up",,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,"MyGreenPC*",,,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"*.mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,,,"mygreenpc.exe",,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,"MyIVO*",,,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,"myivo-server.software.informer.com",,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomanager.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomgr.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLE Remote Access Software*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLERemoteAccessSoftware*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-able*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software",,"n-able.com",,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-Able Advanced Monitoring Agent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-AbleAdvancedMonitoringAgent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.swi-tc.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us.cdn.cloudflare.net",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"Agent_*_RW.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASEClient.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupApp.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvc.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvcCnfg.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"winagent.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"Remote Monitoring*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"N-Able*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-able N-central","N-able N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-ableN-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"*.prd.cdo.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.eu1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.global.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us2.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.ap-southeast-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-central-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-west-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.us-west-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"feeds.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"releases.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"sis.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"swi-rc.cdn-sw.net",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"update.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/Library/MspAgent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/opt/msp-agent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\Msp Agent\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMaint.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMonitor.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"msp-agent-core.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"NTR Remote","NTR Remote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote","NTRRemote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,"*.ntrsupport.com",,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,"NTRsupportPro_EN.exe",,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,,"Net Transmit & Receive SL",RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NVDA (Non-Visual Desktop Access)","NVDA*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)","Non-Visual Desktop Access*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"*.nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files (x86)\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Local\Temp\nvda_*\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Roaming\nvda\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_*.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_service.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +Naverisk,"Naverisk*",,,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,"naverisk.com",,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,"AgentSetup-*.exe",,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"NavMK1 Limited*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"naverisk*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Net Monitor for Employees","Net Monitor for Employees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees","NetMonitorforEmployees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files (x86)\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_agtconfig.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagentsvc.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent64.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +NetBird,"NetBird*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"*.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"192.3.95.152",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"198.46.178.135",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"api.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"app.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-233f9.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-ed980.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-165a0.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"login.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my-sharepoint-inc.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my1cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my2cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"pkgs.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"relay.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"signal.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"web-16fe.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/Applications/NetBird UI.app",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/etc/netbird/install.conf",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/opt/netbird/*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/local/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird-ui.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\ProgramData\Netbird\*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\OpenSSH.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\cis.vbs",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\netbird.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\trm.zip",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\temper\trm",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,netbird,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird-ui.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +"NetLock RMM","NetLock RMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM","NetLockRMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/Library/Application Support/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/local/bin/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/var/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_Process.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_UAC.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer.exe",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +NetMaster,"NetMaster*",,,,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\NetMaster_Client.exe",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\config.ini",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +"NetSupport Manager","NetSupport Manager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupport*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupportManager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"*.netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"geo.netsupportsoftware.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"client32.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcicfgui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcictlui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"remcmdstub.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,,netsupport,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +Netop,"Netop*",,,,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Netop Remote Control\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"C:\Program Files\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Impero Connect*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Netop Remote Control*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","NetopRemoteControl*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.connect.backdrop.cloud",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.netop.com",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Connect.Backdrop.cloud*.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoClientSVC.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoInit.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Netop Ondemand.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ngstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhostsvc.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nldrw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Connect*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Solutions*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","Netop Remote Control*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","NetopRemoteControl*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","aka Impero Connect*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhostsvc.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhstw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nldrw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Connect*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Solutions*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,"Netreo*",,,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"*.api.netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"activation.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"charon.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,"Neturo*",,,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,"neturo.uplus.co.kr",,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo*.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"ntrntservice.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,"Netviewer*",,,,,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer*.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","GoToMeet*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","Netviewer*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"*.netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"NetViewer.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvClient.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvConsole.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,,"Algorius*",RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Nexus RMM (Scogo)","Nexus RMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","NexusRMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","Scogo*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)",,,,"nexusrmm.exe",,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +Nezha,"Nezha*",,,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"c.mid.al",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"gd.bj2.xyz",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"github.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezha.wiki",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezhahq.github.io",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"raw.githubusercontent.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"rism.pages.dev",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"*\nezha-agent.exe",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-agent.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-dashboard.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent/nezha-agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/dashboard",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\Program Files\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"dashboard-windows-amd64.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha_agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +"NinjaOne (formerly NinjaRMM)","NinjaOne*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)","formerly NinjaRMM*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)",,,"*ProgramData\NinjaRMMAgent\*",,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,"NinjaRMM*",,,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"resources.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgent.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgentPatcher.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"ninjarmm-cli.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"Ninja MSP*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"NinjaRMM*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,"NoMachine*",,,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,"nomachine.com",,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nomachine*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxd.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxservice*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,,"NoMachine*",RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,"NordLocker*",,,,,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,NordLocker,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"NordSec Update Service",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"nordvpn*",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktop sharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktopsharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon*.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateonmain.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCS inventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCSinventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,"ocsinventory-ng.org",,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsinventory.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsservice.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"OcsPackager*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"Ocs Inventory*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Obliance,"Obliance*",,,,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/Library/LaunchDaemons/com.obliance.agent.plist",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/obliance-agent/config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-agent.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-watchdog.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/opt/obliance-agent/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/usr/local/bin/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/var/log/obliance-agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-agent.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-tray.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-watchdog.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\watchdog.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Onionshare,"Onionshare*",,,,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\onionshare*.exe",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"C:\Program Files (x86)\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,,"OnionShare-win*.msi",,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Opale,"Opale*",,,,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +Opale,,,"C:\ProgramData\Opale\opale-agent.exe",,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +"OpenDesk RMM Agent","OpenDesk RMM Agent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent","OpenDeskRMMAgent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"OpenDesk-RMM-Agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"opendesk-rmm-agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +OpenUEM,"OpenUEM*",,,,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/Library/OpenUEMAgent/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/var/log/openuem-agent/openuem-agent.log",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\*",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\config\openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\logs\openuem-log.txt",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +"OpsBridge Agent","OpsBridge Agent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent","OpsBridgeAgent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,"opsbridge.digital",,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Program Files\OpsBridge\OpsBridgeAgent.exe",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\ProgramData\OpsBridge\*",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Windows\System32\Tasks\OpsBridge Agent",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +OptiTune,"OptiTune*",,,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.opti-tune.com",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.optitune.us",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTPowerShell.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTService.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"OptiTune*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"Bravura Software*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Overlord,"Overlord*",,,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok-free.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.com",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"pandoramods.top",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"savaliyapriyal874-code.github.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Overlord\agent.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\agent-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\svchost-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,,"ovd_*.exe",,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +PChelpware,"PChelpware*",,,,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +PChelpware,,,"*\PcHelpWare_viewer.exe",,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +"PDQ Connect","PDQ Connect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect","PDQConnect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"app.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"cfcdn.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"pdqinstallers.*.r2.cloudflarestorage.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"PDQConnectUpdater-*.msi",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"pdq-connect*.exe",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQConnectAgent*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQ.com*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","Pandora RC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","PandoraRC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","eHorus*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,"portal.ehorus.com",,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus standalone.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus_agent.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,,"eHorus*",RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,"Panorama9*",,,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"changes.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"trusted.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,"p9agent*.exe",,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,,"Panorama9*",RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Parsec,"Parsec*",,,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"*.parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.gg",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,"C:\Program Files\Parsec\*",,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"parsecd.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"pservice.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Pcnow,"Pcnow*",,,,,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"mwcliun.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"pcnmgr.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"webexpcnow.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,"Pcvisit*",,,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"*.pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit-easysupport.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_service_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,,"pcvisit*",RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,"Pilixo*",,,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"*.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"download.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"Pilixo_Installer*.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"rdp.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,,"Pilixo*",RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Pocket Cloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","PocketCloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Wyse*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloud*.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloudservice.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,,"PocketCloud*",RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","Pocket Controller*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","PocketController*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcloudservice.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcontroller.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"wysebrowser.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Pocket Controller*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","PocketController*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Soti Xsight*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"*.soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"XSightService.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"pocketcontroller.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"wysebrowser.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,,"Pocket Controller*",RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ProxiPort,"ProxiPort*",,,,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/etc/proxiport/proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/lib/systemd/system/proxiport.service",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/usr/bin/proxiport",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.exe",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +Pulseway,"Pulseway*",,,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,"pulseway.com",,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"PCMonitorManager.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"pcmonitorsrv.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"MMSoft Design*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"Pulseway*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQ IM-remote assistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQIM-remoteassistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.desktop.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.mdt.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"qq-messenger.en.softonic.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"upload_data.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"QQProtect.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qq.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qqpcmgr.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"QQ*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"Tencent*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","Quest KACE Agent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","QuestKACEAgent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","formerly Dell KACE*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,"*.kace.com",,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,"konea.exe",,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,,"KACE Agent*",RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","Quick Assist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","QuickAssist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,,,"quickassist.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,"RAdmin*",,,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,"radmin.com",,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Program Files (x86)\Radmin Viewer 3\Radmin.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrf2",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrfc",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\rserver3.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"radmin*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"famatech*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDCMan,"RDCMan*",,,,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan-x86.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDPView,"RDPView*",,,,,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDPView,,,,"dwrcs.exe",,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RES Automation Manager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RESAutomationManager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wisshell*.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc_deployer.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmcsvc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RG System (RG Supervision)","RG Supervision*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RG System*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RGSystem*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"api.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"dashboard.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"lisa.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files (x86)\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +RMMCRAT,"RMMCRAT*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,"softbymade.top",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,,"C:\ProgramData\RMMAgent\*",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMmax,"RMMmax*",,,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,"api.rmmmax.com",,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"%ProgramData%\rmmmax\AgentService\RMMmaxAgentService.exe",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/Applications/RMMmax Agent.app/Contents/MacOS/RMMmax Agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/usr/local/bin/rmmmax-agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/var/rmmmax/agentservice/rmmmax_agent.py",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,,"RMMmaxAgentSetup.exe",,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RPort,"RPort*",,,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,"rport.io",,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,,,"rport.exe",,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RdClient,"RdClient*",,,,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files (x86)\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"RdClientInstaller.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"SupportTool.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"rdclient.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RealVNC,"RealVNC*",,,,,RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RealVNC,,,,,"realvnc*",RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemSupp,"RemSupp*",,,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"api.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"download.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\Uninstall RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\remsupp-updater\installer.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +Remcos,"Remcos*",,,,,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remcos,,,,"remcos*.exe",,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmina,"Remmina*",,,,,RAT,"","Remmina is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,"Remmon*",,,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"*.remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,,,"remmon.exe",,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,"Remobo*",,,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,"remobo.en.softonic.com",,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_client.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_tracker.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Devolutions*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Remote Desktop Manager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","RemoteDesktopManager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","Remote Desktop Plus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","RemoteDesktopPlus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,"donkz.nl",,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,"rdp.exe",,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,,"Remote Desktop Plus*",RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","Remote Manipulator System*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","RemoteManipulatorSystem*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"*.internetid.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"rmansys.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rfusclient.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rutserv.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Ripple","Remote Ripple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple","RemoteRipple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files (x86)\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,,"RemoteRipple.exe",,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Utilities","Remote Utilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities","RemoteUtilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,"*.internetid.ru",,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutserv.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutview.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,,"Remote Utilities*",RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it","Remote.it*",,,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"auth.api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote-it-installer.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote.it.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remoteit.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteAgentAgent,"RemoteAgentAgent*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,"app-af-agent-prod-009.azurewebsites.net",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,,"C:\Program Files\RemoteAgent\RemoteAgentAgent.exe",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteCall,"RemoteCall*",,,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.startsupport.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"agentu.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"raautoup.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcengmgru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcmgrsvc.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"remotesupportplayeru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rxstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,,"RSUPPORT*",RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,"RemotePC*",,,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotedesktop.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"www.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePCService.exe",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"Idrive.File-Transfer",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePC.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePCService.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"idrive.RemotePCAgent",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepchost.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepcservice.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"rpcsuite.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotepc*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotedesktop*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,"RemotePass*",,,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,"remotepass.com",,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"remotepass-access.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpaccess.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpwhostscr.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePulse,"RemotePulse*",,,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"www.remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\agent.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.cmd",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemoteUtilities,"RemoteUtilities*",,,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,"remoteutilities.com",,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Manipulator System - Server\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\rutserv.exe",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"C:\Program Files\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutserv.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutview.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,,"Remote Utilities*",RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,"RemoteView*",,,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"remoteview.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rv.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagent.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagtray.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RsDoctor*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RemoteView*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remotely,"Remotely*",,,,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/Library/LaunchDaemons/remotely-agent.plist",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/etc/systemd/system/remotely-agent.service",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Desktop/Remotely_Desktop",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Remotely_Agent",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Desktop\Remotely_Desktop.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Remotely_Agent.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\etag.txt",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +"Rocket Remote Desktop","Rocket Remote Desktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop","RocketRemoteDesktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RDConsole.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RocketRemoteDesktop_Setup.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rodex RMM","Rodex RMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM","RodexRMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"www.rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Program Files\Rodex\RodexAgent.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Windows\.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"RodexAgent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"rodexagent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +Roster,"Roster*",,,,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/Library/LaunchDaemons/com.roster.agent.plist",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/roster/agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/systemd/system/roster-agent.service",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/usr/local/bin/roster-agent",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/var/log/roster-agent.log",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\Program Files\Roster\*",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent-state.json",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +"Royal Apps","Royal Apps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps","RoyalApps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalserver.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalts.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","Royal Server*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","RoyalServer*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server",,"royalapps.com",,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","Royal TS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","RoyalTS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,"royalapps.com",,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,,,"royalts.exe",,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,"RuDesktop*",,,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"*.rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rd.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rudesktop*.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,"RunSmart*",,,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,,"runsmart.io",,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RustDesk,"RustDesk*",,,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"api.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rs-ny.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"web.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk\RustDesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\*",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\rustdesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk*.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,,"rustdesk*",RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +ScreenConnect,"ScreenConnect*",,,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"control.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"instance-*-relay.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.WindowsClient.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\ScreenConnect Client*\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client (Random)\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"ConnectWiseControl*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"Remote Workforce Client.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"connectwise*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.clientservice.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.windowsclient.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"CONTINUUM MANAGED*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ScreenConnect*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ConnectWise*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,"ScreenMeet*",,,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.screenmeet.com",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.scrn.mt",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeet.Support.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeetSupport.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,,"ScreenMeet*",RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,"SecureCRT*",,,,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\VanDyke Software\ClientPack\*",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"C:\*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,"Seetrol*",,,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,"seetrol.co.kr",,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolcenter.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolclient.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolmyservice.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolremote.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolsetting.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud","Senso.cloud*",,,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"*.senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoClient.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoService.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"aadg.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sentinel RMM","Sentinel RMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM","SentinelRMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/opt/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/usr/local/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"C:\ProgramData\SentinelAgent\sentinel-agent.exe",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +ServerEye,"ServerEye*",,,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,"*.server-eye.de",,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"ServiceProxyLocalSys.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"servereye*.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"Server-Eye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"ServerEye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"SetMe PRO","SetMe PRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO","SetMePRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"*.set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Client\SetMe_Client.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Module\*\tinUnattendedModule.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +ShellHub,"ShellHub*",,,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"*.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"cloud.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"www.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/systemd/system/shellhub-agent.service",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/usr/local/bin/shellhub-agent",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/var/lib/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShowMyPC,"ShowMyPC*",,,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"*.showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"SMPCSetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc*.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"smpcsetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,,"ShowMyPC*",RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SimpleHelp,"SimpleHelp*",,,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"160.191.182.41",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"192.144.34.42",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.178",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.179",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"dronemaker.org",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"microuptime.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"simple-help.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"telesupportgroup.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"%APPDATA%\JWrapper-SimpleSetup\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"C:\ProgramData\JWrapper-Remote Access\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"remote access.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"serviceconfig.xml",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplegatewayservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplehelpcustomer.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simpleservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"spsrv.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"vhost.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"windowslauncher.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,,"SimpleHelp*",RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +Site24x7,"Site24x7*",,,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.cn",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.com",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.eu",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.in",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.net.au",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MEAgentHelper.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MonitoringAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7PluginAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7WindowsAgentTrayIcon.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,"SkyFex*",,,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"*.deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"skyfex.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"DeskRollUA.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"Deskroll.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,,"DeskRoll Remote Desktop*",RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY","Solar-PuTTY*",,,,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-PuTTY.exe",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"C:\Program Files\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-Remote Management System*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-RemoteManagementSystem*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophos.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.net",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"clientmrinit.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"mgntsvc.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"routernt.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,"Sorillus*",,,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"*.sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus Launcher.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus-Launcher*.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SparkRAT,"SparkRAT*",,,,,RAT,"https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/README.md,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/scripts/build.client.sh,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/client/core/core.go,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/server/handler/handler.go,https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/,https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections","SparkRAT (Spark) is an open-source Go remote-access framework with a self-hosted controller that generates configured endpoint clients. It offers remote terminal, desktop, screenshot, file, and process functions. Public reporting has documented malicious SparkRAT deployments; that does not make every deployment of the upstream dual-use project malicious." +Splashtop,"Splashtop*",,,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,"*.splashtop.com",,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"*\Splashtop\Splashtop Remote\Client for RMM\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"C:\Program Files (x86)\Splashtop\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,,"strwinclt.exe",,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Beta*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Splashtop*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,"splashtop.com",,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRManager.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRServer.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SplashtopSOS.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","Splashtop Remote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","SplashtopRemote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.eu",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.relay.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"SplashtopSOS.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"sragent.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srmanager.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srserver.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srservice.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"strwinclt.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,,"Splashtop*",RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,"SpyAnywhere*",,,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"*.spytech-web.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"spyanywhere.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,,,"sysdiag.exe",,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,"SunLogin*",,,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"client.oray.net",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"sunlogin.oray.com",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteService.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteShell.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"sunlogin*.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Remote control service",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Shanghai Best Oray*",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,"SuperOps*",,,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsbeta.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"serv.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superops.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superopsticket.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,,"SuperOps*",RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,"SuperPuTTY*",,,,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\superputty.exe",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"C:\Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,"Supremo*",,,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,"*.supremocontrol.com",,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"%USERPROFILE%\\AppData\\Local\\Temp\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"*\\supremoremotedesktop\\supremosystem.exe",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"C:\\ProgramData\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"SupremoSystem.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremo.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremohelper.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremoservice.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"NanoSystems*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"SupRemo*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,"Syncro*",,,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncroapi.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"app.kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"attachments.servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"ld.aurelius.host",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"repairshopr.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Service.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"KabutoSetup.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Overmind.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Agent.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Syncro*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Servably*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Synergy,"Synergy*",,,,,RAT,"https://symless.com/synergy","Synergy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,"SysAid*",,,,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\IliAS.exe",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAid\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"C:\Program Files\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,"Syspectr*",,,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"*.syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oolocker.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oosyspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"syspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,,"O&O Syspectr*",RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","Tactical RMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","TacticalRMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"docs.tacticalrmm.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"login.tailscale.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,"tacticalrmm.exe",,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"Tactical Techs*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"AmidaWare*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeamViewer,"TeamViewer*",,,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"*.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"client.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"router15.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"taf.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,"C:\Program Files\TeamViewer\",,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_desktop.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_service.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,teamviewerhost,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,,"TeamViewer*",RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeleDesktop,"TeleDesktop*",,,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,"tele-desk.com",,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"pstlaunch.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskclient.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskhost.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Teleport Connect","Teleport Connect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect","TeleportConnect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"*.teleport.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"cdn.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"reporting-connect.teleportinfra.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"usage.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/Applications/Teleport Connect.app/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/opt/Teleport Connect/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/usr/local/bin/tsh",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Program Files\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Users\*\AppData\Local\Programs\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,,"Teleport Connect Setup-*.exe",,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +Teramind,"Teramind*",,,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"*.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"rt.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"sentry.dev.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"www.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/Teramind Agent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/tmagent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/tmsysd",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/etc/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Package Cache\.unverified\agent",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\tmagentsvc.exe",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\updates\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +TiFLUX,"TiFLUX*",,,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"*.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"agent.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"app.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"my.splashtop.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"%ProgramData%\Tiflux\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"/Applications/TiAgent.app",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiUpdateService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\7zip\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\tar\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\si.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +ToDesk,"ToDesk*",,,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"*.todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Service.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Setup.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"todesk.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,,"ToDesk*",RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","Total Software Deployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","TotalSoftwareDeployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Tsdservice.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\tniwinagent.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"C:\ProgramData\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"Total Software Deployment",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"SoftInventive Lab",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TrustConnect,"TrustConnect*",,,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"networkservice.cyou",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"trustconnectsoftware.com",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"*\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\ProgramData\TrustConnect\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"DocConnect.Agent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"TrustConnectAgent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +UltraViewer,"UltraViewer*",,,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"*.ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer\",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_setup*",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"DucFabulous*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"UltraViewer*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"UniSystem RMM","UniSystem RMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM","UniSystemRMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.exe",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.msi",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +VIZOR,"VIZOR*",,,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"downloads.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"mail.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files (x86)\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector Networks Limited\LANutil32 Suite\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +"VNC Connect","VNC Connect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect","VNCConnect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"*\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"C:\Program Files\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Veyon,"Veyon*",,,,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files (x86)\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-master.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-server.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-service.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-wcli.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-worker.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +"Vicarius vRx","Vicarius vRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx","VicariusvRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"*.vicarius.cloud",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.us-east-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-static-organizationinstallations.vicarius-cdn.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/Library/PrivilegedHelperTools/topiad",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/usr/share/vicarius/*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"C:\Program Files\Vicarius\Topia\*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,,"topiad.exe",,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Visual Studio Dev Tunnel","Visual Studio Dev Tunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel","VisualStudioDevTunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.devtunnels.ms",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"global.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,"Weezo*",,,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.me",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.en.softonic.com",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo setup*.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezohttpd.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Weezo*",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Peer 2 World",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,"Xeox*",,,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"*.xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_*.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x64.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x86.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox_service_windows.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,"Xpra*",,,,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-Launcher.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-x86_64_Setup.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"C:\Program Files (x86)\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","Zabbix Agent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","ZabbixAgent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,"zabbix.com",,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,"zabbix_agent*.exe",,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,,"Zabbix*",RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Zecurit,"Zecurit*",,,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"app.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"d1m8kha1zyjal6.cloudfront.net",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"dms.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/CommandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Service",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/ZecuritAccess.app/Contents/MacOS/ZecuritAccess",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/agentService",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/commandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Windows\Temp\Zecurit\ZecuritAgentUpgrader.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +ZeroTier,"ZeroTier*",,,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"*.zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zero-powershell.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.msi",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"zero-powesrhell*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"ZeroTier*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","Zoho Assist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","ZohoAssist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.au",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.eu",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.in",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.jp",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"assist.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohocdn.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohodl.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"gateway.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,"*\ZA_Access.exe",,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZMAgent.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoMeeting.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoURSService.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"Zohours.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"toolsiq.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"za_connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zaservice.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zohotray.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,,"Zoho*",RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"baramundi Management Suite","baramundi Management Suite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite","baramundiManagementSuite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"*.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"docs.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"isodownload.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"www.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +eHorus,"eHorus*",,,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,"ehorus.com",,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,"C:\Program Files\ehorus_agent\*",,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus standalone.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_agent.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_cmd.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_launcher.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_uit.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,"ezHelp*",,,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"*.ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezHelpManager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclient.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclientmanager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,,"Mastersoft Corp*",RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,"pcAnywhere*",,,,,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awhost32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awrem32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"pcaquickconnect.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"winaw32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,"rdp2tcp*",,,,,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.exe",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.py",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +tmate,"tmate*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"*.tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/local/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,tmate,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate-ready",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.bashrc",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.sock",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." diff --git a/lookups/csv/remote_access_software.yml b/lookups/csv/remote_access_software.yml index db897ef6ee..b148e32ea6 100644 --- a/lookups/csv/remote_access_software.yml +++ b/lookups/csv/remote_access_software.yml @@ -1,15 +1,17 @@ name: remote_access_software id: f3b92ff9-667c-481f-b29d-458e10d48508 -version: 5 +version: 6 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Splunk Threat Research Team lookup_type: csv description: A list of Remote Access Software match_type: - - WILDCARD(remote_utility) - - WILDCARD(remote_domain) - - WILDCARD(remote_utility_fileinfo) + - WILDCARD(match_pattern) + - WILDCARD(domain) + - WILDCARD(file_path) + - WILDCARD(file_name) + - WILDCARD(file_info) min_matches: 1 max_matches: 1 case_sensitive_match: false