diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml
index 1738ee9068..c4aeaca59d 100644
--- a/app_template/default/data/ui/nav/default.xml
+++ b/app_template/default/data/ui/nav/default.xml
@@ -4,6 +4,7 @@
+
diff --git a/dashboards/cisco_ai_defense_threat_operations.json b/dashboards/cisco_ai_defense_threat_operations.json
new file mode 100644
index 0000000000..3f12be5c23
--- /dev/null
+++ b/dashboards/cisco_ai_defense_threat_operations.json
@@ -0,0 +1,1010 @@
+{
+ "title": "Cisco AI Defense Threat Operations",
+ "description": "Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections.\n\nThis dashboard uses the `cisco_ai_defense` macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use.",
+ "dataSources": {
+ "ds_filter_applications": {
+ "type": "ds.search",
+ "name": "Available AI applications",
+ "options": {
+ "query": "`cisco_ai_defense`\n| spath path=\"genai_application.application_name\" output=Application\n| eval Application=if(isnull(Application) OR len(trim(Application))=0,if(isnull(application_id) OR len(trim(application_id))=0,\"Unknown application\",application_id),Application)\n| eval application_key=if(isnull(application_id) OR len(trim(application_id))=0,Application,application_id)\n| stats count as event_count values(Application) as application_names values(application_id) as application_id by application_key\n| eval Application=mvjoin(application_names,\" / \")\n| table Application application_key application_id event_count\n| sort 0 Application"
+ }
+ },
+ "ds_filter_models": {
+ "type": "ds.search",
+ "name": "Available AI models",
+ "options": {
+ "query": "`cisco_ai_defense` | search model.model_name!=\"\" | stats count as event_count by model.model_name | rename model.model_name as model_name | table model_name event_count | sort 0 model_name"
+ }
+ },
+ "ds_ai_events_base": {
+ "type": "ds.search",
+ "name": "Cisco AI Defense normalized event base",
+ "options": {
+ "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards"
+ }
+ },
+ "ds_total_events": {
+ "type": "ds.chain",
+ "name": "Total observed events",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| stats dc(event_id) as count"
+ }
+ },
+ "ds_blocked_events": {
+ "type": "ds.chain",
+ "name": "Blocked events",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| stats dc(eval(if(action=\"block\",event_id,null()))) as count"
+ }
+ },
+ "ds_allowed_highrisk": {
+ "type": "ds.chain",
+ "name": "Allowed high-risk events",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| eval is_highrisk=if(mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND is_highrisk=1,event_id,null()))) as count"
+ }
+ },
+ "ds_allowed_sensitive_responses": {
+ "type": "ds.chain",
+ "name": "Allowed sensitive responses",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| eval is_privacy=if(mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND direction=\"response\" AND is_privacy=1,event_id,null()))) as count"
+ }
+ },
+ "ds_redacted_events": {
+ "type": "ds.chain",
+ "name": "Redacted events",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| stats dc(eval(if(action=\"redact\",event_id,null()))) as count"
+ }
+ },
+ "ds_runtime_actions": {
+ "type": "ds.chain",
+ "name": "Runtime actions over time",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| timechart span=1h dc(event_id) as events by action"
+ }
+ },
+ "ds_sensitive_entities": {
+ "type": "ds.chain",
+ "name": "Sensitive entities by action",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| mvexpand entities\n| where isnotnull(entities) AND len(trim(entities))>0\n| chart dc(event_id) over entities by action\n| fillnull value=0"
+ }
+ },
+ "ds_sensitive_event_details": {
+ "type": "ds.chain",
+ "name": "Sensitive match review",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval rulesets=mvjoin(guardrails,\", \"), detected_entities=mvjoin(entities,\", \")\n| sort 0 - _time\n| table _time action direction application_name application_id connection_name model_name policy_name rulesets detected_entities event_id\n| head 100"
+ }
+ },
+ "ds_applications_by_action": {
+ "type": "ds.chain",
+ "name": "Observed applications by event volume",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| stats dc(event_id) as events values(application_name) as application_names values(application_id) as application_ids values(action) as actions values(model_name) as models by application_key\n| eval application_name=mvjoin(application_names,\" / \"), application_id=mvjoin(application_ids,\", \")\n| eval actions=mvjoin(mvsort(actions),\", \"), models=mvjoin(mvsort(models),\", \")\n| sort 0 - events\n| head 15\n| rename application_name as Application application_id as \"Application ID\" events as Events actions as Actions models as \"Models observed\"\n| table Application \"Application ID\" Events Actions \"Models observed\""
+ }
+ },
+ "ds_models_by_action": {
+ "type": "ds.chain",
+ "name": "Observed events by model and action",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| stats dc(event_id) as events by model_name action\n| chart max(events) over model_name by action\n| fillnull value=0"
+ }
+ },
+ "ds_ai_detection_readiness": {
+ "type": "ds.search",
+ "name": "ESCU AI Defense detection readiness",
+ "options": {
+ "query": "| makeresults\n| eval detection_name=split(\"Cisco AI Defense Security Alerts by Application Name|Cisco AI Defense Repeated High Risk Activity|Cisco AI Defense Allowed Sensitive Response|Cisco AI Defense Allowed Sensitive Prompt\",\"|\")\n| mvexpand detection_name\n| eval expected_savedsearch=\"ESCU - \".detection_name.\" - Rule\", ai_system=\"Cisco AI Defense\", mapped=1, data_sources=\"Cisco AI Defense Alerts\"\n| fields ai_system detection_name expected_savedsearch mapped data_sources\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | where title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\"), app_name=coalesce('eai:acl.app','eai:appName',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window app_name ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window values(app_name) as app_name by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\"), scheduled=coalesce(mvindex(scheduled,0),\"Missing\"), finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\",enabled!=\"Enabled\",\"Disabled\",scheduled!=\"Scheduled\",\"Not scheduled\",finding_output==\"No risk/notable\",\"No risk/notable action\",true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \"), schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\"), app_name=coalesce(mvindex(app_name,0),\"\")\n| sort readiness detection_name\n| rename detection_name as Detection expected_savedsearch as \"Saved Search\" readiness as Readiness finding_output as \"Finding Output\" schedule as Schedule window as Window app_name as App data_sources as \"Data Sources\"\n| table Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window App \"Data Sources\"",
+ "queryParameters": {
+ "earliest": "0",
+ "latest": "now"
+ }
+ }
+ },
+ "ds_live_ai_findings_base": {
+ "type": "ds.search",
+ "name": "Cisco AI Defense ESCU risk and notable results",
+ "options": {
+ "query": "search (index=risk OR index=notable)\n [ | makeresults\n | eval savedsearch_title=mvappend(\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\", \"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | mvexpand savedsearch_title\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0,\"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\",\"source=\\\"__cisco_ai_defense_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"Risk event\",index=\"notable\",\"Notable\",true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),search_name,null()),if(match(source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),source,null()),if(match(savedsearch_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),savedsearch_name,null()),if(match(orig_source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),orig_source,null()),if(match(rule_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),rule_name,null()))\n| where savedsearch_title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n| eval detection=replace(replace(savedsearch_title,\"^ESCU - \",\"\"),\" - Rule$\",\"\")\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score,risk_score))\n| eval severity=case(finding_source=\"Risk event\",lower(coalesce(severity,case(risk_numeric>=80,\"critical\",risk_numeric>=50,\"high\",risk_numeric>=20,\"medium\",risk_numeric>0,\"low\",true(),\"unknown\"))),finding_source=\"Notable\",lower(coalesce(severity,urgency,\"unknown\")),true(),lower(coalesce(severity,\"unknown\")))\n| eval entity=case(finding_source=\"Risk event\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"),finding_source=\"Notable\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,rule_name,\"unknown\"),true(),coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"))\n| eval detail=case(finding_source=\"Risk event\",coalesce(risk_message,source,search_name,detection,\"\"),finding_source=\"Notable\",coalesce(rule_description,description,rule_name,detection,\"\"),true(),coalesce(risk_message,rule_description,source,detection,\"\"))\n| eval detail=substr(detail,1,500), event_key=coalesce(event_id,source_event_id,sid,_cd,tostring(_time).\"|\".savedsearch_title.\"|\".entity.\"|\".coalesce(detail,\"\"))\n| dedup event_key detection\n| fields _time finding_source detection severity risk_numeric entity detail savedsearch_title"
+ }
+ },
+ "ds_live_findings_by_detection": {
+ "type": "ds.chain",
+ "name": "ESCU finding counts by detection",
+ "options": {
+ "extend": "ds_live_ai_findings_base",
+ "query": "| stats count as Findings dc(entity) as Entities by detection finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval detection=\"No matching detection results\", finding_source=\"Status\", Findings=0, Entities=0 | fields - result_count ]\n| sort 0 - Findings"
+ }
+ },
+ "ds_live_findings_over_time": {
+ "type": "ds.chain",
+ "name": "ESCU findings over time",
+ "options": {
+ "extend": "ds_live_ai_findings_base",
+ "query": "| timechart span=1d count by finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval _time=now(), \"No detection results\"=0 | fields _time \"No detection results\" ]\n| fillnull value=0"
+ }
+ },
+ "ds_live_findings_detail": {
+ "type": "ds.chain",
+ "name": "Recent ESCU AI Defense Findings",
+ "options": {
+ "extend": "ds_live_ai_findings_base",
+ "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort 0 -_time\n| table eventTime finding_source severity detection entity risk_numeric detail\n| appendpipe [ | stats count as result_count | where result_count==0 | eval eventTime=\"\", finding_source=\"Status\", severity=\"info\", detection=\"No matching detection results\", entity=\"No risk/notable events in selected time window\", risk_numeric=0, detail=\"This table populates when one of the four Cisco AI Defense ESCU detections produces risk or notable output.\" | fields - result_count ]"
+ }
+ },
+ "ds_attack_outcomes": {
+ "type": "ds.chain",
+ "name": "High-risk activity by enforcement outcome",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(eval(if(action=\"allow\",event_id,null()))) as count"
+ }
+ },
+ "ds_blocked_attack_outcomes": {
+ "type": "ds.chain",
+ "name": "Blocked high-risk activity",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where action=\"block\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count"
+ }
+ },
+ "ds_allowed_sensitive_response_count": {
+ "type": "ds.chain",
+ "name": "Allowed sensitive responses",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where action=\"allow\" AND direction=\"response\" AND mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count"
+ }
+ },
+ "ds_repeated_event_ids": {
+ "type": "ds.chain",
+ "name": "Repeated high-risk event IDs",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where isnotnull(event_id) AND len(trim(event_id))>0 AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| bin _time span=10m\n| stats count as Occurrences values(application_name) as application_names values(application_id) as application_ids values(connection_name) as connection_names values(connection_id) as connection_ids values(action) as Actions values(direction) as Directions values(guardrails) as Guardrails values(model_name) as Models by _time application_key connection_key event_id\n| eval application_name=mvjoin(application_names,\" / \"), connection_name=mvjoin(connection_names,\" / \"), application_id=mvjoin(application_ids,\", \"), connection_id=mvjoin(connection_ids,\", \")\n| where Occurrences>=3\n| eval Window=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| rename application_name as Application connection_name as Connection event_id as \"Event ID\"\n| table Window Application Connection \"Event ID\" Occurrences Actions Directions Guardrails Models\n| sort 0 - Occurrences\n| head 100"
+ }
+ },
+ "ds_attack_paths": {
+ "type": "ds.search",
+ "name": "Risky behavior by direction and policy outcome",
+ "options": {
+ "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards\n| mvexpand guardrails\n| eval attack_class=case(match(guardrails,\"(?i)prompt injection\"),\"Prompt injection\",match(guardrails,\"(?i)code detection\"),\"Code generation or abuse\",match(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\"),\"Sensitive data (PII/PCI)\",true(),null())\n| where isnotnull(attack_class)\n| eval attack_path=attack_class.\" / \".coalesce(direction,\"unknown\")\n| stats dc(event_id) as events by attack_path action\n| chart max(events) over attack_path by action\n| fillnull value=0\n| sort 0 attack_path"
+ }
+ },
+ "ds_allowed_risk_cases": {
+ "type": "ds.chain",
+ "name": "Allowed high-risk paths for review",
+ "options": {
+ "extend": "ds_ai_events_base",
+ "query": "| where action=\"allow\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval attack_class=case(mvfind(guardrails,\"(?i)prompt injection\")>=0,\"Prompt injection\",mvfind(guardrails,\"(?i)code detection\")>=0,\"Code generation or abuse\",mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,\"Sensitive data (PII/PCI)\",true(),\"Other high-risk\")\n| stats dc(event_id) as Events values(application_id) as application_ids values(application_name) as application_names values(direction) as Directions values(guardrails) as Guardrails values(entities) as Entities values(policy_name) as Policies values(connection_name) as Connections by application_key model_name attack_class\n| eval application_id=mvjoin(application_ids,\", \")\n| eval Application=mvjoin(application_names,\" / \"), \"Application ID\"=mvjoin(application_ids,\", \")\n| eval Directions=mvjoin(Directions,\", \"), Guardrails=mvjoin(Guardrails,\", \"), Entities=mvjoin(Entities,\", \"), Policies=mvjoin(Policies,\", \"), Connections=mvjoin(Connections,\", \")\n| rename model_name as Model attack_class as \"Attack class\"\n| sort 0 - Events\n| head 100\n| table Application \"Application ID\" Model \"Attack class\" Events Directions Guardrails Entities Policies Connections"
+ }
+ }
+ },
+ "visualizations": {
+ "viz_threat_header": {
+ "type": "splunk.markdown",
+ "options": {
+ "markdown": "## Cisco AI Defense | Threat Overview\nRuntime enforcement, allowed high-risk activity, and sensitive response signals. Use Application and Model filters to focus event telemetry."
+ }
+ },
+ "viz_total_events": {
+ "type": "splunk.singlevalue",
+ "title": "Events Observed",
+ "description": "Distinct Cisco AI Defense event IDs in the selected time range.",
+ "dataSources": {
+ "primary": "ds_total_events"
+ },
+ "options": {
+ "majorFontSize": 30,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off"
+ }
+ },
+ "viz_blocked_events": {
+ "type": "splunk.singlevalue",
+ "title": "Blocked Events",
+ "description": "Distinct events blocked by AI Defense.",
+ "dataSources": {
+ "primary": "ds_blocked_events"
+ },
+ "options": {
+ "majorFontSize": 30,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off"
+ }
+ },
+ "viz_allowed_highrisk": {
+ "type": "splunk.singlevalue",
+ "title": "Allowed High-Risk Events",
+ "description": "Allowed events matching prompt-injection, code, PII, or PCI guardrails.",
+ "dataSources": {
+ "primary": "ds_allowed_highrisk"
+ },
+ "options": {
+ "majorFontSize": 30,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off"
+ }
+ },
+ "viz_allowed_sensitive_responses": {
+ "type": "splunk.singlevalue",
+ "title": "Sensitive Responses Allowed",
+ "description": "Allowed responses matching PII or PCI privacy guardrails.",
+ "dataSources": {
+ "primary": "ds_allowed_sensitive_responses"
+ },
+ "options": {
+ "majorFontSize": 30,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off"
+ }
+ },
+ "viz_repeat_window_count": {
+ "type": "splunk.singlevalue",
+ "title": "Redacted Events",
+ "description": "Distinct events redacted by AI Defense in the selected time range.",
+ "dataSources": {
+ "primary": "ds_redacted_events"
+ },
+ "options": {
+ "majorFontSize": 30,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off"
+ }
+ },
+ "viz_risk_timeline": {
+ "type": "splunk.line",
+ "title": "Runtime Enforcement Over Time",
+ "description": "Hourly volume by observed action. This includes all events, not only high-risk matches.",
+ "dataSources": {
+ "primary": "ds_runtime_actions"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "xAxisTitleText": "Time",
+ "yAxisTitleText": "Events",
+ "seriesColorsByField": {
+ "block": "#D64545",
+ "allow": "#3B82F6",
+ "redact": "#F59E0B",
+ "monitor": "#2F9E76"
+ }
+ }
+ },
+ "viz_sensitive_entities": {
+ "type": "splunk.bar",
+ "title": "Sensitive Entities by Action",
+ "description": "PII/PCI entity categories observed in events; message content is not shown.",
+ "dataSources": {
+ "primary": "ds_sensitive_entities"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "xAxisTitleVisibility": "hide",
+ "yAxisTitleText": "Distinct events",
+ "stackMode": "stacked",
+ "seriesColorsByField": {
+ "allow": "#F59E0B",
+ "block": "#D64545",
+ "redact": "#2F9E76"
+ }
+ }
+ },
+ "viz_repeat_windows": {
+ "type": "splunk.table",
+ "title": "Sensitive Match Review",
+ "description": "Event-level PII/PCI matches with application, model, policy, and entity metadata. Prompt and response text is omitted.",
+ "dataSources": {
+ "primary": "ds_sensitive_event_details"
+ },
+ "options": {
+ "headerVisibility": "fixed",
+ "count": 50,
+ "wrap": true
+ }
+ },
+ "viz_priority_queue": {
+ "type": "splunk.table",
+ "title": "Recent ESCU AI Defense Findings",
+ "description": "Actual risk or notable records attributed to the four Cisco AI Defense ESCU detections. The empty state is informational, not a synthetic finding.",
+ "dataSources": {
+ "primary": "ds_live_findings_detail"
+ },
+ "options": {
+ "headerVisibility": "fixed",
+ "count": 50,
+ "wrap": true
+ }
+ },
+ "viz_header_attack_activity": {
+ "type": "splunk.markdown",
+ "options": {
+ "markdown": "## Attack Activity\n\n### Prompt or Response → Guardrail Match → Policy Action\n\nCompare risky behavior with enforcement outcomes, then review allowed paths and repeated event IDs. Counts describe observed events; the dashboard does not infer a successful compromise."
+ }
+ },
+ "viz_header_data_exposure": {
+ "type": "splunk.markdown",
+ "options": {
+ "markdown": "## Data Exposure\nReview PII/PCI entities and affected applications, models, policies, and event direction. Payload text is intentionally excluded."
+ }
+ },
+ "viz_apps_activity": {
+ "type": "splunk.table",
+ "title": "Most Active Observed Applications",
+ "dataSources": {
+ "primary": "ds_applications_by_action"
+ },
+ "options": {
+ "count": 15,
+ "drilldown": "none",
+ "wrap": true
+ },
+ "description": "Applications observed in Cisco AI Defense runtime events."
+ },
+ "viz_models_activity": {
+ "type": "splunk.bar",
+ "title": "Observed Activity by Model and Action",
+ "dataSources": {
+ "primary": "ds_models_by_action"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "seriesColorsByField": {
+ "allow": "#3B82F6",
+ "block": "#D64545",
+ "redact": "#F59E0B",
+ "monitor": "#2F9E76"
+ }
+ },
+ "description": "Model names are taken from runtime events; unknown means the model field was not present."
+ },
+ "viz_detection_readiness": {
+ "type": "splunk.table",
+ "title": "Configured Detection Status",
+ "dataSources": {
+ "primary": "ds_ai_detection_readiness"
+ },
+ "options": {
+ "count": 10,
+ "drilldown": "none",
+ "wrap": true,
+ "columnFormat": {
+ "Readiness": {
+ "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColorConfig)"
+ }
+ }
+ },
+ "description": "Shows whether each expected saved search is present, enabled, scheduled, and configured for risk/notable output. Requires saved-search REST visibility.",
+ "context": {
+ "ReadinessColorConfig": [
+ {
+ "match": "Ready",
+ "value": "#4C8B5B"
+ },
+ {
+ "match": "Disabled",
+ "value": "#B5432F"
+ },
+ {
+ "match": "Missing saved search",
+ "value": "#B5432F"
+ },
+ {
+ "match": "Not scheduled",
+ "value": "#C99A3B"
+ },
+ {
+ "match": "No risk/notable action",
+ "value": "#C99A3B"
+ }
+ ]
+ }
+ },
+ "viz_findings_by_detection": {
+ "type": "splunk.bar",
+ "title": "Generated Findings by Detection and Source",
+ "dataSources": {
+ "primary": "ds_live_findings_by_detection"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "stackMode": "stacked",
+ "seriesColorsByField": {
+ "Risk event": "#C99A3B",
+ "Notable": "#B5432F"
+ }
+ },
+ "description": "Risk and notable events attributed to the Cisco AI Defense detections."
+ },
+ "viz_findings_over_time": {
+ "type": "splunk.line",
+ "title": "Detection Output Over Time",
+ "dataSources": {
+ "primary": "ds_live_findings_over_time"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "seriesColorsByField": {
+ "Risk event": "#C99A3B",
+ "Notable": "#B5432F",
+ "No detection results": "#C9CDD1"
+ }
+ },
+ "description": "Daily risk and notable events generated by these detections."
+ },
+ "viz_header_app_model": {
+ "type": "splunk.markdown",
+ "options": {
+ "markdown": "## Application and Model Activity\nExplore Cisco AI Defense runtime event volume across observed applications and models."
+ }
+ },
+ "viz_header_detection_activity": {
+ "type": "splunk.markdown",
+ "options": {
+ "markdown": "## Detection Coverage and Outcomes\nReview configured Cisco AI Defense detections and the risk or notable events they generate."
+ }
+ },
+ "viz_allowed_risk_count": {
+ "type": "splunk.singlevalue",
+ "title": "Allowed High-Risk Events",
+ "description": "Distinct allowed events matching prompt injection, code, PII, or PCI guardrails.",
+ "dataSources": {
+ "primary": "ds_attack_outcomes"
+ },
+ "options": {
+ "majorFontSize": 34,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off",
+ "backgroundColor": "> majorValue | rangeValue(valueColor)"
+ },
+ "context": {
+ "valueColor": [
+ {
+ "to": 0,
+ "value": "#2B755C"
+ },
+ {
+ "from": 1,
+ "value": "#A33D3D"
+ }
+ ]
+ }
+ },
+ "viz_blocked_risk_count": {
+ "type": "splunk.singlevalue",
+ "title": "Blocked High-Risk Events",
+ "description": "Distinct high-risk events blocked by AI Defense.",
+ "dataSources": {
+ "primary": "ds_blocked_attack_outcomes"
+ },
+ "options": {
+ "majorFontSize": 34,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off",
+ "backgroundColor": "> majorValue | rangeValue(valueColor)"
+ },
+ "context": {
+ "valueColor": [
+ {
+ "to": 0,
+ "value": "#263B46"
+ },
+ {
+ "from": 1,
+ "value": "#197B72"
+ }
+ ]
+ }
+ },
+ "viz_allowed_sensitive_response_count": {
+ "type": "splunk.singlevalue",
+ "title": "Sensitive Responses Allowed",
+ "description": "Distinct allowed responses matching PII or PCI guardrails.",
+ "dataSources": {
+ "primary": "ds_allowed_sensitive_response_count"
+ },
+ "options": {
+ "majorFontSize": 34,
+ "sparklineDisplay": "off",
+ "trendDisplay": "off",
+ "backgroundColor": "> majorValue | rangeValue(valueColor)"
+ },
+ "context": {
+ "valueColor": [
+ {
+ "to": 0,
+ "value": "#263B46"
+ },
+ {
+ "from": 1,
+ "value": "#A33D3D"
+ }
+ ]
+ }
+ },
+ "viz_attack_paths": {
+ "type": "splunk.bar",
+ "title": "Risky Behavior by Direction and Policy Outcome",
+ "description": "Distinct events classified from prompt-injection, code, and PII/PCI guardrails.",
+ "dataSources": {
+ "primary": "ds_attack_paths"
+ },
+ "options": {
+ "legendDisplay": "bottom",
+ "stackMode": "stacked",
+ "seriesColorsByField": {
+ "allow": "#D96C5F",
+ "block": "#47B8AE",
+ "monitor": "#D6A443",
+ "redact": "#8D7BD6"
+ }
+ }
+ },
+ "viz_allowed_risk_cases": {
+ "type": "splunk.table",
+ "title": "Allowed High-Risk Paths Requiring Review",
+ "description": "Allowed events grouped by application, model, guardrail, and message direction. Message content is excluded.",
+ "dataSources": {
+ "primary": "ds_allowed_risk_cases"
+ },
+ "options": {
+ "headerVisibility": "fixed",
+ "count": 25,
+ "wrap": true
+ }
+ },
+ "viz_repeated_event_ids": {
+ "type": "splunk.table",
+ "title": "Repeated High-Risk Event IDs",
+ "description": "Event IDs with three or more high-risk occurrences in a ten-minute bucket, matching the repeated-activity detection threshold.",
+ "dataSources": {
+ "primary": "ds_repeated_event_ids"
+ },
+ "options": {
+ "headerVisibility": "fixed",
+ "count": 25,
+ "wrap": true
+ }
+ }
+ },
+ "inputs": {
+ "input_global_time": {
+ "type": "input.timerange",
+ "title": "Time range",
+ "options": {
+ "token": "global_time",
+ "defaultValue": "-7d@d,now"
+ }
+ },
+ "input_application": {
+ "type": "input.multiselect",
+ "title": "Application",
+ "options": {
+ "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
+ "token": "application_tok",
+ "defaultValue": "*",
+ "clearDefaultOnSelection": true
+ },
+ "dataSources": {
+ "primary": "ds_filter_applications"
+ },
+ "context": {
+ "formattedConfig": {
+ "number": {
+ "prefix": ""
+ }
+ },
+ "formattedStatics": ">statics | formatByType(formattedConfig)",
+ "statics": [
+ [
+ "All"
+ ],
+ [
+ "*"
+ ]
+ ],
+ "label": ">primary | seriesByName(\"Application\") | renameSeries(\"label\") | formatByType(formattedConfig)",
+ "value": ">primary | seriesByName(\"application_key\") | renameSeries(\"value\") | formatByType(formattedConfig)"
+ }
+ },
+ "input_model": {
+ "type": "input.multiselect",
+ "title": "Model",
+ "options": {
+ "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
+ "token": "model_tok",
+ "defaultValue": "*",
+ "clearDefaultOnSelection": true
+ },
+ "dataSources": {
+ "primary": "ds_filter_models"
+ },
+ "context": {
+ "formattedConfig": {
+ "number": {
+ "prefix": ""
+ }
+ },
+ "formattedStatics": ">statics | formatByType(formattedConfig)",
+ "statics": [
+ [
+ "All"
+ ],
+ [
+ "*"
+ ]
+ ],
+ "label": ">primary | seriesByName(\"model_name\") | renameSeries(\"label\") | formatByType(formattedConfig)",
+ "value": ">primary | seriesByName(\"model_name\") | renameSeries(\"value\") | formatByType(formattedConfig)"
+ }
+ }
+ },
+ "layout": {
+ "tabs": {
+ "items": [
+ {
+ "layoutId": "layout_overview",
+ "label": "Threat Overview"
+ },
+ {
+ "layoutId": "layout_attack_activity",
+ "label": "Attack Activity"
+ },
+ {
+ "layoutId": "layout_data_exposure",
+ "label": "Data Exposure"
+ },
+ {
+ "layoutId": "layout_app_model",
+ "label": "Applications & Models"
+ },
+ {
+ "layoutId": "layout_detection_activity",
+ "label": "ESCU Detection Coverage"
+ }
+ ]
+ },
+ "layoutDefinitions": {
+ "layout_overview": {
+ "type": "absolute",
+ "options": {
+ "height": 900,
+ "width": 1440,
+ "display": "auto-scale",
+ "gutterSize": 10
+ },
+ "structure": [
+ {
+ "item": "viz_threat_header",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 0,
+ "w": 1440,
+ "h": 80
+ }
+ },
+ {
+ "item": "viz_total_events",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 90,
+ "w": 288,
+ "h": 130
+ }
+ },
+ {
+ "item": "viz_blocked_events",
+ "type": "block",
+ "position": {
+ "x": 288,
+ "y": 90,
+ "w": 288,
+ "h": 130
+ }
+ },
+ {
+ "item": "viz_allowed_highrisk",
+ "type": "block",
+ "position": {
+ "x": 576,
+ "y": 90,
+ "w": 288,
+ "h": 130
+ }
+ },
+ {
+ "item": "viz_allowed_sensitive_responses",
+ "type": "block",
+ "position": {
+ "x": 864,
+ "y": 90,
+ "w": 288,
+ "h": 130
+ }
+ },
+ {
+ "item": "viz_repeat_window_count",
+ "type": "block",
+ "position": {
+ "x": 1152,
+ "y": 90,
+ "w": 288,
+ "h": 130
+ }
+ },
+ {
+ "item": "viz_risk_timeline",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 230,
+ "w": 1440,
+ "h": 600
+ }
+ }
+ ]
+ },
+ "layout_attack_activity": {
+ "type": "absolute",
+ "options": {
+ "height": 1050,
+ "width": 1440,
+ "display": "auto-scale",
+ "gutterSize": 10
+ },
+ "structure": [
+ {
+ "item": "viz_header_attack_activity",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 0,
+ "w": 1440,
+ "h": 110
+ }
+ },
+ {
+ "item": "viz_allowed_risk_count",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 120,
+ "w": 480,
+ "h": 135
+ }
+ },
+ {
+ "item": "viz_blocked_risk_count",
+ "type": "block",
+ "position": {
+ "x": 480,
+ "y": 120,
+ "w": 480,
+ "h": 135
+ }
+ },
+ {
+ "item": "viz_allowed_sensitive_response_count",
+ "type": "block",
+ "position": {
+ "x": 960,
+ "y": 120,
+ "w": 480,
+ "h": 135
+ }
+ },
+ {
+ "item": "viz_attack_paths",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 265,
+ "w": 1440,
+ "h": 360
+ }
+ },
+ {
+ "item": "viz_allowed_risk_cases",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 635,
+ "w": 720,
+ "h": 390
+ }
+ },
+ {
+ "item": "viz_repeated_event_ids",
+ "type": "block",
+ "position": {
+ "x": 720,
+ "y": 635,
+ "w": 720,
+ "h": 390
+ }
+ }
+ ]
+ },
+ "layout_data_exposure": {
+ "type": "absolute",
+ "options": {
+ "height": 980,
+ "width": 1440,
+ "display": "auto-scale",
+ "gutterSize": 10
+ },
+ "structure": [
+ {
+ "item": "viz_header_data_exposure",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 0,
+ "w": 1440,
+ "h": 80
+ }
+ },
+ {
+ "item": "viz_sensitive_entities",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 90,
+ "w": 1440,
+ "h": 350
+ }
+ },
+ {
+ "item": "viz_repeat_windows",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 450,
+ "w": 1440,
+ "h": 480
+ }
+ }
+ ]
+ },
+ "layout_app_model": {
+ "type": "absolute",
+ "options": {
+ "height": 1120,
+ "width": 1440,
+ "display": "auto-scale",
+ "gutterSize": 10
+ },
+ "structure": [
+ {
+ "item": "viz_header_app_model",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 0,
+ "w": 1440,
+ "h": 80
+ }
+ },
+ {
+ "item": "viz_apps_activity",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 90,
+ "w": 1440,
+ "h": 470
+ }
+ },
+ {
+ "item": "viz_models_activity",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 570,
+ "w": 1440,
+ "h": 470
+ }
+ }
+ ]
+ },
+ "layout_detection_activity": {
+ "type": "absolute",
+ "options": {
+ "height": 1350,
+ "width": 1440,
+ "display": "auto-scale",
+ "gutterSize": 10
+ },
+ "structure": [
+ {
+ "item": "viz_header_detection_activity",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 0,
+ "w": 1440,
+ "h": 100
+ }
+ },
+ {
+ "item": "viz_detection_readiness",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 110,
+ "w": 1440,
+ "h": 300
+ }
+ },
+ {
+ "item": "viz_findings_by_detection",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 420,
+ "w": 720,
+ "h": 340
+ }
+ },
+ {
+ "item": "viz_findings_over_time",
+ "type": "block",
+ "position": {
+ "x": 720,
+ "y": 420,
+ "w": 720,
+ "h": 340
+ }
+ },
+ {
+ "item": "viz_priority_queue",
+ "type": "block",
+ "position": {
+ "x": 0,
+ "y": 770,
+ "w": 1440,
+ "h": 520
+ }
+ }
+ ]
+ }
+ },
+ "globalInputs": [
+ "input_global_time",
+ "input_application",
+ "input_model"
+ ],
+ "options": {
+ "submitButton": true,
+ "submitOnDashboardLoad": true,
+ "showTitleAndDescription": true
+ }
+ },
+ "defaults": {
+ "dataSources": {
+ "ds.search": {
+ "options": {
+ "queryParameters": {
+ "earliest": "$global_time.earliest$",
+ "latest": "$global_time.latest$"
+ }
+ }
+ }
+ }
+ }
+}
diff --git a/dashboards/cisco_ai_defense_threat_operations.yml b/dashboards/cisco_ai_defense_threat_operations.yml
new file mode 100644
index 0000000000..a86c953ba7
--- /dev/null
+++ b/dashboards/cisco_ai_defense_threat_operations.yml
@@ -0,0 +1,9 @@
+name: Cisco AI Defense Threat Operations
+id: 7b8213d0-61e3-46ec-9c8b-b6ab5820b849
+version: 1
+creation_date: '2026-10-18'
+modification_date: '2026-10-18'
+author: Nasreddine Bencherchali, Splunk
+description: |-
+ Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections.
+ This dashboard uses the cisco_ai_defense macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use.
diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml
index 2eba8da408..60efe8e519 100644
--- a/data_sources/cisco_ai_defense_alerts.yml
+++ b/data_sources/cisco_ai_defense_alerts.yml
@@ -1,11 +1,11 @@
name: Cisco AI Defense Alerts
id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e
-version: 2
+version: 3
creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel
+modification_date: '2026-10-15'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
description: Data source object for Cisco AI Defense Alerts
-source: cisco_ai_defense
+source: not_applicable
sourcetype: cisco:ai:defense
separator:
supported_TA:
@@ -13,3 +13,60 @@ supported_TA:
url: https://splunkbase.splunk.com/app/7404
version: 4.1.2
fields:
+ - _time
+ - host
+ - app
+ - application_id
+ - connection_id
+ - connection.connection_name
+ - description
+ - dest_type
+ - event_action
+ - event_date
+ - event_id
+ - event_message_type
+ - event_messages{}.event_conversation.event_messages{}.content
+ - event_messages{}.event_conversation.event_messages{}.direction
+ - event_messages{}.event_conversation.event_messages{}.event_conversation_id
+ - event_messages{}.event_conversation.event_messages{}.event_ext_message_id
+ - event_messages{}.event_conversation.event_messages{}.event_ins_date
+ - event_messages{}.event_conversation.event_messages{}.event_message_id
+ - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs
+ - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id
+ - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}
+ - event_messages{}.event_conversation.event_messages{}.related_event_message_id
+ - event_messages{}.event_conversation.event_messages{}.tenant_id
+ - event_messages{}.event_ext_message_id
+ - event_messages{}.event_message_id
+ - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name
+ - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type
+ - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type
+ - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name
+ - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id
+ - eventtype
+ - genai_application.application_name
+ - genai_application.connection_type
+ - hec_event_type
+ - id
+ - index
+ - linecount
+ - model.model_name
+ - model.model_provider_name
+ - Number
+ - policy_id
+ - policy.policy_name
+ - punct
+ - resource_type
+ - signature
+ - signature_id
+ - source
+ - sourcetype
+ - splunk_server
+ - src_type
+ - tag
+ - tag::eventtype
+ - type
+ - user_id
+ - vendor_product
+example_log: |
+ {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]}
diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml
index 5445233c45..6b84113316 100644
--- a/data_sources/osquery_results.yml
+++ b/data_sources/osquery_results.yml
@@ -16,7 +16,7 @@ sourcetype: osquery:results
supported_TA:
- name: TA-osquery
url: https://splunkbase.splunk.com/app/8574
- version: 1.0.4
+ version: 1.0.5
fields:
- _time
- calendarTime
diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml
index 29522a4daa..d7d7f55286 100644
--- a/data_sources/splunk_stream_http.yml
+++ b/data_sources/splunk_stream_http.yml
@@ -16,7 +16,7 @@ sourcetype: stream:http
supported_TA:
- name: Splunk Add-on for Stream Wire Data
url: https://splunkbase.splunk.com/app/5234
- version: 8.1.6
+ version: 8.1.7
fields:
- _time
- bytes
diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml
index a5ffb18d05..1fbea55486 100644
--- a/data_sources/splunk_stream_ip.yml
+++ b/data_sources/splunk_stream_ip.yml
@@ -16,7 +16,7 @@ sourcetype: stream:ip
supported_TA:
- name: Splunk Add-on for Stream Wire Data
url: https://splunkbase.splunk.com/app/5234
- version: 8.1.6
+ version: 8.1.7
fields:
- _time
- action
diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml
index a15f404188..710bb9cb0b 100644
--- a/data_sources/splunk_stream_tcp.yml
+++ b/data_sources/splunk_stream_tcp.yml
@@ -16,4 +16,4 @@ sourcetype: stream:tcp
supported_TA:
- name: Splunk Add-on for Stream Wire Data
url: https://splunkbase.splunk.com/app/5234
- version: 8.1.6
+ version: 8.1.7
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
new file mode 100644
index 0000000000..79100e68a4
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -0,0 +1,96 @@
+name: Cisco AI Defense Allowed Sensitive Prompt
+id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+ Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+ These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
+data_source:
+ - Cisco AI Defense Alerts
+search: |-
+ `cisco_ai_defense`
+ event_action="allow"
+ event_message_type="prompt"
+
+ | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+ guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+ application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+ connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+ application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+
+ connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+
+ policy_name='policy.policy_name',
+
+ event_time=_time
+
+ | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+ | bin _time span=10m
+
+ | stats count as event_count
+ dc(event_id) as distinct_event_count
+ min(event_time) as firstTime
+ max(event_time) as lastTime
+ values(event_id) as event_ids
+ values(guardrail_ruleset_type) as guardrail_ruleset_types
+ values(guardrail_entity_name) as guardrail_entity_names
+ values(policy_name) as policy_names
+ values(application_name) as application_names
+ values(connection_name) as connection_names
+ by _time application_key connection_key
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+
+ | table _time firstTime lastTime application_key application_names connection_key connection_names
+ distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names
+
+ | `cisco_ai_defense_allowed_sensitive_prompt_filter`
+how_to_implement: |-
+ Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+ Confirm that extraction is enabled for the required fields as shown in the detection search.
+ Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+ The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings.
+known_false_positives: |-
+ Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails.
+ Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation.
+drilldown_searches:
+ - name: View the detection results for - "$application_names$"
+ search: '%original_detection_search% | search application_names="$application_names$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+finding:
+ title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$].
+ entity:
+ field: application_key
+ type: other
+ score: 50
+threat_objects: []
+analytic_story:
+ - Abuse of GenAI Systems and Applications
+ - Data Protection
+ - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+ source: not_applicable
+ sourcetype: cisco:ai:defense
+ test_type: unit
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
new file mode 100644
index 0000000000..4c823a71c6
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -0,0 +1,73 @@
+name: Cisco AI Defense Allowed Sensitive Response
+id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+ Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+ These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
+data_source:
+ - Cisco AI Defense Alerts
+search: |-
+ `cisco_ai_defense`
+ event_action="allow"
+ event_message_type="response"
+
+ | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+ guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+ application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+ connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+ policy_name='policy.policy_name'
+
+ | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+ | table _time event_date event_id event_message_type event_action resource_type
+ application_id application_name connection_id connection_name model.model_name
+ policy_name guardrail_ruleset_type guardrail_entity_name
+
+ | `cisco_ai_defense_allowed_sensitive_response_filter`
+how_to_implement: |-
+ Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+ Confirm that extraction is enabled for the required fields as shown in the detection search.
+ Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+ Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails.
+ Review the application owner, policy, response context, and whether the data was expected to be disclosed.
+drilldown_searches:
+ - name: View the detection results for - "$application_name$"
+ search: '%original_detection_search% | search application_name="$application_name$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+finding:
+ title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$].
+ entity:
+ field: application_name
+ type: other
+ score: 50
+threat_objects: []
+analytic_story:
+ - Abuse of GenAI Systems and Applications
+ - Data Protection
+ - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+ source: not_applicable
+ sourcetype: cisco:ai:defense
+ test_type: unit
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
new file mode 100644
index 0000000000..d267fb97c7
--- /dev/null
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -0,0 +1,96 @@
+name: Cisco AI Defense Repeated High Risk Activity
+id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+ Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
+ Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
+ These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.
+data_source:
+ - Cisco AI Defense Alerts
+search: |-
+ `cisco_ai_defense`
+
+ ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
+
+ | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0)
+ | where is_allowed_sensitive_prompt=0
+
+ | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+ application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+ connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+ application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+ connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
+
+ | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+ | bin _time span=10m
+
+ ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs```
+ | eventstats count as same_event_id_count by _time application_key connection_key event_id
+
+ | stats count as event_count
+ dc(event_id) as distinct_event_count
+ max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count
+ values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids
+ count(eval(lower(event_action)="allow")) as allowed_event_count
+ count(eval(lower(event_action)="block")) as blocked_event_count
+ values(event_id) as event_ids
+ values(event_action) as event_actions
+ values(event_message_type) as message_types
+ values(policy.policy_name) as policy_names
+ values(guardrail_ruleset_type) as guardrail_ruleset_types
+ values(connection_name) as connection_names
+ values(application_name) as application_names
+ by _time application_key connection_key
+
+ | where distinct_event_count>=5 OR max_same_event_id_count>=3
+
+ | table _time application_key application_names connection_key connection_names
+ event_count distinct_event_count max_same_event_id_count repeated_event_ids
+ allowed_event_count blocked_event_count event_actions message_types policy_names
+ guardrail_ruleset_types event_ids
+
+ | `cisco_ai_defense_repeated_high_risk_activity_filter`
+how_to_implement: |-
+ Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk.
+ Confirm that extraction is enabled for the required fields as shown in the detection search.
+ Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+ Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed.
+known_false_positives: |-
+ Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events.
+ Review whether the window contains allowed events and whether the activity was expected for the application and connection.
+drilldown_searches:
+ - name: View the detection results for - "$application_key$"
+ search: '%original_detection_search% | search application_key="$application_key$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+finding:
+ title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$].
+ entity:
+ field: application_key
+ type: other
+ score: 50
+threat_objects: []
+analytic_story:
+ - Abuse of GenAI Systems and Applications
+ - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+ source: not_applicable
+ sourcetype: cisco:ai:defense
+ test_type: unit
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index cf1d7ef9e3..277f239b0f 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,45 +1,107 @@
name: Cisco AI Defense Security Alerts by Application Name
id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 7
+version: 8
creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel, Splunk
+modification_date: '2026-10-19'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
-description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
+description: |-
+ This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
+ Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
+ Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
+ Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
data_source:
- Cisco AI Defense Alerts
search: |-
`cisco_ai_defense`
- | rename genai_application.application_name as application_name
- | rename connection.connection_name as connection_name
- ```Aggregating data by model name, connection name, application name, application ID, and user ID```
- | stats count
- values(user_id) as user_id
- values(event_message_type) as event_message_type
- values(event_action) as event_action
- values(policy.policy_name) as policy_name
- values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name
- values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type
- by model.model_name connection_name application_name application_id
- ```Evaluating severity based on policy name and guardrail ruleset type```
- | eval severity=case(
- policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical",
- policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high",
- guardrail_ruleset_type IN ("Toxicity"), "medium",
+
+ | rename genai_application.application_name as application_name,
+ connection.connection_name as connection_name
+
+ | eval policy_name='policy.policy_name',
+
+ guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+ guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+ action=lower(event_action), message_type=lower(event_message_type),
+
+ has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0),
+
+ has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0),
+
+ has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0)
+
+ ```Prioritize allowed sensitive responses, then security and privacy guardrails```
+
+ | eval severity=case(
+ action="allow" AND has_sensitive_response=1, "critical",
+ action="block" AND has_sensitive_response=1, "high",
+ action="allow" AND has_security=1, "high",
+ action="block" AND has_security=1, "medium",
+ action="allow" AND has_privacy=1, "high",
+ action="block" AND has_privacy=1, "medium",
true(), "low"
)
- ```Calculating risk score based on severity level```
- | eval risk_score=case(
- severity="critical", 100,
- severity="high", 75,
- severity="medium", 50,
- severity="low", 25
- )
- | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name
- | `cisco_ai_defense_security_alerts_by_application_name_filter`
-how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype.
-known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
+
+ | eval risk_score=case(
+ severity="critical", 100,
+ severity="high", 80,
+ severity="medium", 50,
+ severity="low", 20
+ )
+
+ | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"),
+ connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"),
+ application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+ connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+ is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0),
+ is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0),
+ is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0),
+ high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()),
+ event_time=_time
+
+ | bin _time span=10m
+
+ ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity```
+ | eventstats count as same_high_risk_event_count by _time application_key connection_key high_risk_event_id
+ | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
+
+ ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
+ | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND (high_risk_event_count>=5 OR same_high_risk_event_count>=3))
+
+ | stats count as event_count
+ dc(event_id) as distinct_event_count
+ min(event_time) as firstTime
+ max(event_time) as lastTime
+ values(event_id) as event_ids
+ values(event_action) as event_actions
+ values(event_message_type) as message_types
+ values(resource_type) as resource_types
+ values(model.model_name) as model_names
+ values(application_name) as application_name
+ values(connection_name) as connection_name
+ values(policy_name) as policy_names
+ values(guardrail_ruleset_type) as guardrail_ruleset_types
+ values(guardrail_entity_name) as guardrail_entity_names
+ max(risk_score) as risk_score
+ by _time application_key connection_key action message_type severity
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+
+ | table _time firstTime lastTime application_key application_name connection_key connection_name
+ action message_type severity risk_score event_count distinct_event_count event_ids
+ resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names
+
+ | `cisco_ai_defense_security_alerts_by_application_name_filter`
+how_to_implement: |-
+ Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+ Confirm that extraction is enabled for the required fields as shown in the detection search.
+ Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+ False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
references:
- https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4
- https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html
@@ -57,8 +119,10 @@ intermediate_findings:
- field: application_name
type: other
score: 20
- message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$]
+ message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$].
+threat_objects: []
analytic_story:
+ - Abuse of GenAI Systems and Applications
- Critical Alerts
asset_type: Web Application
mitre_attack_id: []
@@ -72,7 +136,7 @@ tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
- source: cisco_ai_defense
+ source: not_applicable
sourcetype: cisco:ai:defense
- description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
- test_type: experimental
+ description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
+ test_type: unit
diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml
index 2a48c92012..a995b6fa33 100644
--- a/detections/application/ollama_abnormal_network_connectivity.yml
+++ b/detections/application/ollama_abnormal_network_connectivity.yml
@@ -2,7 +2,7 @@ name: Ollama Abnormal Network Connectivity
id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb
version: 6
creation_date: '2025-10-13'
-modification_date: '2026-10-09'
+modification_date: '2026-10-19'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
@@ -25,6 +25,7 @@ search: |-
"*unreachable*"
)
+ | eval dest=coalesce(dest, host)
| bin _time span=5m
| stats count as incidents
values(msg) as warning_messages
diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml
index 0dd0538dec..4daf45811f 100644
--- a/detections/application/ollama_repeated_application_errors.yml
+++ b/detections/application/ollama_repeated_application_errors.yml
@@ -2,7 +2,7 @@ name: Ollama Repeated Application Errors
id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71
version: 1
creation_date: '2026-10-09'
-modification_date: '2026-10-09'
+modification_date: '2026-10-19'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
@@ -17,11 +17,12 @@ search: |-
| rex field=_raw "msg=\"(?[^\"]+)\""
| rex field=_raw "exit_code=(?\d+)"
+ | eval event_time=_time
| bin _time span=5m
| stats count as error_count
- earliest(_time) as first_seen
- latest(_time) as last_seen
+ earliest(event_time) as first_seen
+ latest(event_time) as last_seen
values(msg) as error_messages
values(exit_code) as exit_codes
dc(msg) as unique_errors
diff --git a/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
new file mode 100644
index 0000000000..9243a8a30d
--- /dev/null
+++ b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
@@ -0,0 +1,111 @@
+name: AWS Anomalous Secrets Manager Batch Retrieval
+id: 93646bda-291b-4a59-a926-19f08e26f7cd
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: >-
+ The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within
+ one hour.
+ It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID.
+ Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
+data_source:
+ - AWS CloudTrail
+search: |-
+ `cloudtrail`
+ eventName="BatchGetSecretValue"
+ eventSource="secretsmanager.amazonaws.com"
+
+ | eval user_arn='userIdentity.arn',
+ vendor_account=recipientAccountId
+
+ | where isnotnull(user_arn) AND isnotnull(vendor_account)
+ AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+
+ | eval event_key=coalesce(eventID, md5(_raw))
+
+ | dedup event_key
+
+ | eval event_time=_time
+
+ | sort 0 + _time
+
+ | streamstats time_window=1h count AS rolling_batch_request_count
+ min(event_time) AS window_start
+ BY vendor_account user_arn
+
+ | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
+ BY vendor_account user_arn
+
+ | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
+ BY vendor_account user_arn
+
+ | where isnotnull(qualifying_start)
+ AND event_time>=qualifying_start
+ AND event_time<=qualifying_end
+
+ | stats count AS batch_request_count
+ values(sourceIPAddress) AS src
+ values(userAgent) AS user_agent
+ values(awsRegion) AS vendor_region
+ earliest(event_time) AS firstTime
+ latest(event_time) AS lastTime
+
+ BY vendor_account user_arn
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `aws_anomalous_secrets_manager_batch_retrieval_filter`
+how_to_implement: |-
+ Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype.
+known_false_positives: |-
+ Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time.
+ A principal may trigger the detection again when it has not used the API during the preceding seven days.
+ Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized.
+references:
+ - https://attack.mitre.org/techniques/T1555/006/
+ - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
+ - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html
+ - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html
+drilldown_searches:
+ - name: View detection results for - "$user_arn$"
+ search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+ - name: View Secrets Manager activity for the last 7 days for - "$user_arn$"
+ search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters'
+ earliest_offset: 7d
+ latest_offset: "0"
+ - name: View risk events for the last 7 days for - "$user_arn$"
+ search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+ earliest_offset: 7d
+ latest_offset: "0"
+finding:
+ title: The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour
+ entity:
+ field: user_arn
+ type: user
+ score: 40
+threat_objects:
+ - field: src
+ type: ip_address
+analytic_story:
+ - AWS Identity and Access Management Account Takeover
+asset_type: AWS Account
+mitre_attack_id:
+ - T1555.006
+product:
+ - Splunk Cloud
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
+ source: aws_cloudtrail
+ sourcetype: aws:cloudtrail
+ test_type: unit
diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index 3bf1241d2d..9b8530cbb5 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -1,28 +1,61 @@
name: AWS CreateAccessKey
id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
-version: 11
+version: 12
creation_date: '2021-03-02'
-modification_date: '2026-05-13'
-author: Bhavin Patel, Splunk
+modification_date: '2026-10-19'
+author: Bhavin Patel, Radka Viskova, Splunk
status: production
type: Hunting
-description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
+description: |-
+ This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user.
+ Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
+ Hunting queries are designed to be run manually during threat hunting activities.
data_source:
- AWS CloudTrail CreateAccessKey
search: |-
- `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success
- | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
- | search match=0
- | rename user_name as user
- | stats count min(_time) as firstTime max(_time) as lastTime
- BY signature dest user
- user_agent src vendor_account
- vendor_region vendor_product
- | `security_content_ctime(firstTime)`
- | `security_content_ctime(lastTime)`
- | `aws_createaccesskey_filter`
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
-known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
+ `cloudtrail`
+ eventName = CreateAccessKey
+
+ | where (isnull(errorCode) OR errorCode="success")
+ AND 'userIdentity.type'="IAMUser"
+ AND isnotnull('userIdentity.userName')
+ AND isnotnull('requestParameters.userName')
+ AND 'userIdentity.userName'!='requestParameters.userName'
+
+ | eval
+ caller_arn='userIdentity.arn',
+ caller_principal_id='userIdentity.principalId',
+ caller_user='userIdentity.userName',
+ dest=coalesce(dest,eventSource),
+ signature=coalesce(signature,eventName),
+ src=coalesce(src,sourceIPAddress),
+ target_user='requestParameters.userName',
+ user_agent=coalesce(user_agent,userAgent),
+ user_arn=coalesce(user_arn,caller_arn),
+ vendor_account=coalesce(vendor_account,recipientAccountId),
+ vendor_product=coalesce(vendor_product,"AWS"),
+ vendor_region=coalesce(vendor_region,awsRegion)
+
+ | stats count min(_time) as firstTime
+ max(_time) as lastTime
+ values(dest) as dest
+ values(eventID) as eventIDs
+ values(signature) as signature
+ values(src) as src
+ values(user_agent) as user_agent
+ values(user_arn) as user_arn
+ values(vendor_product) as vendor_product
+ values(vendor_region) as vendor_region
+
+ by vendor_account caller_user caller_principal_id target_user
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `aws_createaccesskey_filter`
+how_to_implement: |-
+ You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+known_false_positives: |-
+ While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
references:
- https://bishopfox.com/blog/privilege-escalation-in-aws
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
diff --git a/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml
new file mode 100644
index 0000000000..ecb853e891
--- /dev/null
+++ b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml
@@ -0,0 +1,75 @@
+name: AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity
+id: 62afb4a9-d9d0-464a-9326-aacf61c5a9f2
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+ Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval.
+ EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
+ A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
+data_source:
+ - AWS CloudTrail
+search: |-
+ `cloudtrail`
+ eventSource="ec2-instance-connect.amazonaws.com"
+ eventName="SendSSHPublicKey"
+ responseElements.success=true
+
+ | stats dc('requestParameters.instanceId') as unique_instances
+ dc(eventID) as event_count
+ earliest(_time) as firstTime
+ latest(_time) as lastTime
+ values('requestParameters.instanceId') as targeted_instances
+ values('requestParameters.instanceOSUser') as targeted_users
+ values(src) as src
+ values(user_agent) as user_agent
+ values(vendor_region) as vendor_region
+ by user_arn
+
+ | where event_count >= 10
+
+ | eval duration_seconds=lastTime-firstTime
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+ Administrators and automated orchestration may legitimately use EC2 Instance Connect repeatedly during fleet administration, troubleshooting,
+ or ephemeral-access workflows.
+ Review the AWS identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process.
+references:
+ - https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html
+ - https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/
+ - https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-14-aws-ec2-instance-connect-ssh-public-key-uploaded.html
+finding:
+ title: The AWS identity [$user_arn$] uploaded [$event_count$] SSH public keys using EC2 Instance Connect
+ entity:
+ field: user_arn
+ type: user
+ score: 50
+threat_objects:
+ - field: src
+ type: ip_address
+analytic_story:
+ - Suspicious Cloud Instance Activities
+asset_type: AWS Account
+mitre_attack_id:
+ - T1021.004
+ - T1021.008
+product:
+ - Splunk Cloud
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json
+ sourcetype: aws:cloudtrail
+ source: aws_cloudtrail
+ test_type: unit
diff --git a/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml
new file mode 100644
index 0000000000..ec33d41248
--- /dev/null
+++ b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml
@@ -0,0 +1,93 @@
+name: AWS EC2 Startup Script Modified on Stopped Instance
+id: 84578867-02bf-475e-9815-6e8e0d798253
+version: 1
+creation_date: '2026-10-07'
+modification_date: '2026-10-07'
+author: Maria Jose Erquiaga
+status: production
+type: TTP
+description: |-
+ A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
+ This may indicate an attempt to change instance startup behavior or establish persistence.
+ These CloudTrail events do not confirm that the modified user-data script executed.
+data_source:
+ - AWS CloudTrail
+search: |-
+ `cloudtrail`
+ eventSource="ec2.amazonaws.com"
+ eventName IN ("StopInstances", "ModifyInstanceAttribute")
+
+ | eval user_arn='userIdentity.arn'
+
+ | eval instance_id=case(
+ eventName="StopInstances", 'requestParameters.instancesSet.items{}.instanceId',
+ eventName="ModifyInstanceAttribute", 'requestParameters.instanceId'
+ )
+
+ | mvexpand instance_id
+
+ | where isnotnull(eventID) AND isnotnull(instance_id) AND isnotnull(user_arn)
+ AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+
+ | where eventName="StopInstances"
+ OR (eventName="ModifyInstanceAttribute" AND 'requestParameters.attribute'="userData")
+
+ | dedup eventID instance_id
+
+ | eval event_epoch=coalesce(strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ"), _time)
+
+ | sort 0 user_arn instance_id awsRegion event_epoch
+
+ | streamstats current=f
+ last(eval(if(eventName="StopInstances", event_epoch, null()))) AS stop_epoch
+ last(eval(if(eventName="StopInstances", eventID, null()))) AS stop_event_id
+ BY user_arn instance_id awsRegion
+
+ | where eventName="ModifyInstanceAttribute" AND isnotnull(stop_epoch)
+
+ | eval elapsed_seconds=event_epoch-stop_epoch
+
+ | where elapsed_seconds>0 AND elapsed_seconds<=3600
+
+ | eval stop_time_utc=strftime(stop_epoch, "%Y-%m-%dT%H:%M:%SZ")
+
+ | eval modification_time_utc=strftime(event_epoch, "%Y-%m-%dT%H:%M:%SZ")
+
+ | rename eventID AS modification_event_id
+
+ | table user_arn instance_id awsRegion stop_time_utc modification_time_utc
+ elapsed_seconds stop_event_id modification_event_id
+
+ | `aws_ec2_startup_script_modified_on_stopped_instance_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+ Authorized administrators and infrastructure automation may stop instances and update their user data.
+ Review the IAM principal, instance, change window, and approved automation before escalating.
+references:
+ - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html
+ - https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-user-data/
+finding:
+ title: The IAM principal [$user_arn$] modified user data on stopped EC2 instance [$instance_id$]
+ entity:
+ field: user_arn
+ type: user
+ score: 50
+threat_objects: []
+analytic_story:
+ - Suspicious Cloud User Activities
+asset_type: AWS Account
+mitre_attack_id:
+ - T1578.005
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: cloud
+security_domain: threat
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json
+ sourcetype: aws:cloudtrail
+ source: aws_cloudtrail
+ test_type: unit
diff --git a/detections/cloud/aws_iam_role_created_with_external_trust.yml b/detections/cloud/aws_iam_role_created_with_external_trust.yml
new file mode 100644
index 0000000000..2cd8511116
--- /dev/null
+++ b/detections/cloud/aws_iam_role_created_with_external_trust.yml
@@ -0,0 +1,122 @@
+name: AWS IAM Role Created with External Trust
+id: 6b7f646b-5ddc-48c9-baa3-fd66ac202c18
+version: 1
+creation_date: '2026-10-13'
+modification_date: '2026-10-13'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+ Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
+ principal.
+ This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
+data_source:
+ - AWS CloudTrail
+search: |-
+ `cloudtrail`
+ eventSource="iam.amazonaws.com"
+ eventName="CreateRole"
+
+ | where isnull(errorCode) OR errorCode="" OR lower(errorCode)="success"
+
+ | eval policy_raw='requestParameters.assumeRolePolicyDocument',
+ role_name='requestParameters.roleName',
+ role_arn='responseElements.role.arn',
+ user_arn=coalesce(user_arn, 'userIdentity.arn'),
+ src=coalesce(src, sourceIPAddress)
+
+ | where isnotnull(policy_raw)
+
+ | eval policy=if(match(policy_raw, "(?i)^%7b"), urldecode(policy_raw), policy_raw)
+
+ | rex field=role_arn "^arn:[^:]+:iam::(?[0-9]{12}):role/"
+
+ | eval role_account_id=coalesce(account_from_role_arn, recipientAccountId)
+ | eval statements_json=json_extract(policy, "Statement")
+ | eval statements=if(match(statements_json, "^\s*\["), json_array_to_mv(statements_json), statements_json)
+
+ | mvexpand statements
+
+ | eval effect=json_extract(statements, "Effect"),
+ actions_json=json_extract(statements, "Action"),
+ principal_json=json_extract(statements, "Principal")
+
+ | eval actions=if(match(actions_json, "^\s*\["), json_array_to_mv(actions_json, true()), actions_json)
+
+ | mvexpand actions
+ | mvexpand actions
+
+ | eval trust_action=actions
+ | eval action_pattern=replace(replace(lower(trust_action), "[*]", "%"), "[?]", "_")
+
+ | where effect="Allow" AND like("sts:assumerole", action_pattern)
+ | eval aws_json=json_extract(principal_json, "AWS")
+
+ | eval principals=case(
+ match(aws_json, "^\s*\["), json_array_to_mv(aws_json, true()),
+ isnotnull(aws_json), aws_json,
+ principal_json="*", "*"
+ )
+
+ | mvexpand principals
+
+ | eval trust_principal=principals
+
+ | rex field=trust_principal "^arn:[^:]+:iam::(?[0-9]{12}):"
+
+ | eval principal_account_id=if(
+ match(trust_principal, "^[0-9]{12}$"),
+ trust_principal,
+ principal_account_from_arn
+ )
+
+ | eval trust_type=case(
+ trust_principal="*", "wildcard",
+ isnotnull(role_account_id) AND isnotnull(principal_account_id)
+ AND principal_account_id!=role_account_id, "external"
+ )
+
+ | where trust_type="wildcard" OR trust_type="external"
+
+ | eval event_key=coalesce(eventID, md5(_raw))
+
+ | dedup event_key trust_principal
+
+ | table _time eventID user_arn src role_name role_arn role_account_id
+ trust_type trust_principal principal_account_id trust_action
+
+ | `aws_iam_role_created_with_external_trust_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+ Approved cross-account integrations and deliberately configured wildcard trust may match.
+ Review the role owner, trust-policy conditions, role permissions, and whether the principal is expected.
+references:
+ - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html
+ - https://stratus-red-team.cloud/attack-techniques/aws/aws.persistence.iam-backdoor-role/
+finding:
+ title: The AWS IAM role [$role_name$] created with [$trust_type$] trust
+ entity:
+ field: user_arn
+ type: user
+ score: 50
+threat_objects:
+ - field: src
+ type: ip_address
+analytic_story:
+ - AWS IAM Privilege Escalation
+asset_type: AWS Account
+mitre_attack_id:
+ - T1098.003
+product:
+ - Splunk Cloud
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json
+ sourcetype: aws:cloudtrail
+ source: aws_cloudtrail
+ test_type: unit
diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml
new file mode 100644
index 0000000000..8ae7fe7b90
--- /dev/null
+++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml
@@ -0,0 +1,112 @@
+name: AWS Repeated CloudWatch Logs Read Operations
+id: 3f0ba9e1-c6cf-4317-a6bc-c4bcab2b5a06
+version: 1
+creation_date: '2026-09-21'
+modification_date: '2026-09-21'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+ The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a
+ five-minute period.
+ It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
+ This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
+data_source:
+ - AWS CloudTrail
+search: |-
+ `cloudtrail`
+ eventSource="logs.amazonaws.com"
+ eventName IN (
+ "DescribeLogGroups",
+ "DescribeLogStreams",
+ "DownloadLogEvents",
+ "FilterLogEvents",
+ "GetLogEvents",
+ "GetQueryResults"
+ )
+
+ | eval user='userIdentity.principalId'
+ | eval vendor_account=coalesce(
+ vendor_account,
+ recipientAccountId,
+ 'userIdentity.accountId'
+ )
+ | eval role_name='userIdentity.sessionContext.sessionIssuer.userName'
+ | eval signature=coalesce(signature, eventName)
+ | eval src=coalesce(src, sourceIPAddress)
+ | eval user_agent=coalesce(user_agent, userAgent)
+ | eval vendor_region=coalesce(vendor_region, awsRegion)
+
+ | where isnotnull(user) AND len(trim(user)) > 0
+
+ | dedup eventID keepempty=true
+
+ | sort 0 _time
+
+ | streamstats time_window=5m count AS event_count
+ by user vendor_account
+
+ | where event_count > 500
+
+ | stats max(_time) AS lastTime
+ max(event_count) AS event_count
+ min(_time) AS firstTime
+ values(role_name) AS role_name
+ values(signature) AS api_operations
+ values(src) AS src
+ values(user_agent) AS user_agent
+ values(vendor_region) AS vendor_region
+ by user vendor_account
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `aws_repeated_cloudwatch_logs_read_operations_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+ Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read
+ CloudWatch Logs and generate a high volume of matching operations.
+ The prevalence of this activity has not yet been evaluated against broader customer telemetry.
+ Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating.
+references:
+ - https://attack.mitre.org/techniques/T1530/
+ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html
+ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html
+ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html
+ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html
+ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html
+drilldown_searches:
+ - name: View CloudWatch Logs read operations for - "$user$"
+ search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+ - name: View risk events for the last 7 days for - "$user$"
+ search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+ earliest_offset: 7d
+ latest_offset: "0"
+finding:
+ title: The AWS principal [$user$] performed [$event_count$] CloudWatch Logs read operations
+ entity:
+ field: user
+ type: user
+ score: 50
+threat_objects:
+ - field: src
+ type: ip_address
+analytic_story:
+ - Data Exfiltration
+asset_type: AWS Account
+mitre_attack_id:
+ - T1530
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: cloud
+security_domain: threat
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
+ sourcetype: aws:cloudtrail
+ source: aws_cloudtrail
+ test_type: unit
diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml
index 0746d33835..0e87d168f0 100644
--- a/detections/endpoint/detect_remote_access_software_usage_file.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_file.yml
@@ -1,9 +1,9 @@
name: Detect Remote Access Software Usage File
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
-version: 17
+version: 18
creation_date: '2024-03-06'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-19'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |
@@ -21,31 +21,56 @@ search: |
count min(_time) as firstTime,
max(_time) as lastTime
values(Filesystem.file_path) as file_path
- from datamodel=Endpoint.Filesystem
- where Filesystem.file_name IN (
- "*.app",
- "*.exe",
- "*.msi",
- "*.pkg",
- "*echoware.dll",
- "*Idrive.*",
- "*rdp2tcp.py"
- )
- by Filesystem.action Filesystem.dest Filesystem.file_access_time
+
+ FROM datamodel=Endpoint.Filesystem WHERE
+
+ [
+ | inputlookup remote_access_software
+ | search file_name!=""
+ | rename file_name as Filesystem.file_name
+ | table Filesystem.file_name
+ ]
+ OR
+ [
+ | inputlookup remote_access_software
+ | search file_path!=""
+ | rename file_path as Filesystem.file_path
+ | table Filesystem.file_path
+ ]
+
+ BY Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size
Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
+
+ | `drop_dm_object_name(Filesystem)`
+
+ | lookup local=t remote_access_software file_name OUTPUT app as name_signature, category as name_category, reference as name_reference, description as name_description
+ | lookup local=t remote_access_software file_path OUTPUT app as path_signature, category as path_category, reference as path_reference, description as path_description
+ | eval signature=coalesce(nullif(name_signature, ""), path_signature),
+ category=coalesce(nullif(name_category, ""), path_category),
+ reference=coalesce(nullif(name_reference, ""), path_reference),
+ description=coalesce(nullif(name_description, ""), path_description)
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | `drop_dm_object_name(Filesystem)`
- | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category
- | search isutility = TRUE
+
| `remote_access_software_usage_exceptions`
+
| `detect_remote_access_software_usage_file_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
-known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+how_to_implement: |-
+ The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to
+ provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest
+ logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate
+ Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint`
+ data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The
+ "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
+ that lets you track and maintain device-based exceptions for this set of detections.
+known_false_positives: |-
+ Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the
+ remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -68,11 +93,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
- message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
+ message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$].
- field: user
type: user
score: 20
- message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$.
+ message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$].
threat_objects:
- field: file_name
type: file_name
diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
index b7e8eb806b..30aabcc494 100644
--- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
@@ -1,30 +1,56 @@
name: Detect Remote Access Software Usage FileInfo
id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
-version: 16
+version: 17
creation_date: '2024-03-06'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-08'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
+description: |-
+ The following analytic detects the execution of processes with file or code signing attributes from known remote access software within
+ the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk,
+ GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access.
+ If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further
+ compromise of the network.
data_source:
- Sysmon EventID 1
search: |-
`sysmon` EventCode=1
- | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product
- BY action dest original_file_name
- parent_process parent_process_exec parent_process_guid
- parent_process_id parent_process_name parent_process_path
- process process_exec process_guid
- process_hash process_id process_integrity_level
- process_name process_path user
- user_id vendor_product
- | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category
- | search isutility = True
- | `remote_access_software_usage_exceptions`
- | `detect_remote_access_software_usage_fileinfo_filter`
-how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
-known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+ [
+ | inputlookup remote_access_software
+ | search file_info!=""
+ | rename file_info as Product
+ | table Product
+ ]
+
+ | stats count min(_time) as firstTime
+ max(_time) as lastTime
+ values(Company) as Company
+ values(Product) as Product
+
+ BY action dest original_file_name
+ parent_process parent_process_exec parent_process_guid
+ parent_process_id parent_process_name parent_process_path
+ process process_exec process_guid
+ process_hash process_id process_integrity_level
+ process_name process_path user
+ user_id vendor_product
+
+ | lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+
+ | `remote_access_software_usage_exceptions`
+
+ | `detect_remote_access_software_usage_fileinfo_filter`
+how_to_implement: |-
+ This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for
+ Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a
+ KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
+known_false_positives: |-
+ Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the
+ remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -47,11 +73,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
- message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
+ message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].
- field: user
type: user
score: 20
- message: A file attributes for known a remote access software [$process_name$] was detected on $dest$
+ message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$].
threat_objects:
- field: process_name
type: process_name
diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml
index b579e35a22..7b110aa899 100644
--- a/detections/endpoint/detect_remote_access_software_usage_process.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_process.yml
@@ -1,35 +1,63 @@
name: Detect Remote Access Software Usage Process
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
-version: 18
+version: 19
creation_date: '2024-03-06'
-modification_date: '2026-10-09'
-author: Steven Dick, Sebastian Wurl, Splunk Community
+modification_date: '2026-10-19'
+author: Steven Dick, Sebastian Wurl, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
+description: |-
+ The following analytic detects the execution of known remote access software within the environment.
+ It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
- from datamodel=Endpoint.Processes
- where
- [| inputlookup remote_access_software where isutility=TRUE
- | rename remote_utility AS Processes.process_name
- | fields Processes.process_name]
- AND Processes.dest!="unknown"
- AND Processes.user!="unknown"
- by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
+ | tstats `security_content_summariesonly`
+ count min(_time) as firstTime
+ max(_time) as lastTime
+ values(Processes.parent_process) as parent_process
+
+ FROM datamodel=Endpoint.Processes WHERE
+
+ [
+ | inputlookup remote_access_software
+ | search file_name!=""
+ | rename file_name as Processes.process_name
+ | table Processes.process_name
+ ]
+
+ Processes.dest!="unknown"
+ Processes.user!="unknown"
+
+ BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
+ Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
+ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
+ Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
+ Processes.vendor_product
+
+ | `drop_dm_object_name(Processes)`
+
+ | lookup local=t remote_access_software file_name AS process_name OUTPUT app as signature, category, reference, description
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | `drop_dm_object_name(Processes)`
- | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
- | search isutility = TRUE
+
| `remote_access_software_usage_exceptions`
+
| `detect_remote_access_software_usage_process_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
-known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+how_to_implement: |-
+ The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related
+ telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name,
+ and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology
+ Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common
+ Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities
+ lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
+known_false_positives: |-
+ It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional
+ remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup
+ to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -63,11 +91,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
- message: A process for a known remote access software $process_name$ was identified on $dest$.
+ message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$].
- field: user
type: user
score: 20
- message: A process for a known remote access software $process_name$ was identified on $dest$.
+ message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$].
threat_objects:
- field: process_name
type: process_name
diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml
index f000f5d3d4..29e4ee8140 100644
--- a/detections/endpoint/detect_remote_access_software_usage_registry.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml
@@ -1,17 +1,86 @@
name: Detect Remote Access Software Usage Registry
id: 33804986-25dd-43cf-bb6b-dc14956c7cbc
-version: 14
+version: 15
creation_date: '2024-12-28'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-19'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
+description: |-
+ The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment.
+ Adversaries use these utilities to retain remote access capabilities to the environment.
+ Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
data_source:
- Sysmon EventID 13
-search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`'
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
-known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+search: |-
+ | tstats `security_content_summariesonly`
+ count min(_time) as firstTime
+ max(_time) as lastTime
+ latest(Registry.process_guid) as process_guid
+
+ FROM datamodel=Endpoint.Registry WHERE
+
+ (
+ Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*"
+ OR
+ (
+ Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*"
+ Registry.registry_value_name="ImagePath"
+ )
+ )
+ (
+ [
+ | inputlookup remote_access_software
+ | search file_name!=""
+ | eval file_name="*".file_name."*"
+ | rex mode=sed field=file_name "s/\*\*/\*/g"
+ | rename file_name as Registry.registry_value_data
+ | table Registry.registry_value_data
+ ]
+ OR
+ [
+ | inputlookup remote_access_software
+ | search file_path!=""
+ | eval file_path="*".file_path."*"
+ | rex mode=sed field=file_path "s/\*\*/\*/g"
+ | rename file_path as Registry.registry_value_data
+ | table Registry.registry_value_data
+ ]
+ )
+
+ BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
+ Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
+ Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
+
+ | `drop_dm_object_name(Registry)`
+
+ | rex field=registry_value_data "(?i)(?:^|\x5c)(?[^\x5c/\x27\x22]+\.\w{2,5})\b"
+ | rex field=registry_value_data "(?i)(?\w:\x5c(?:[^\x5c/\x27\x22]+\x5c)+[^\x5c/\x27\x22]+\.\w{2,5})\b"
+
+ | lookup local=t remote_access_software file_name OUTPUT app as name_signature, category as name_category, reference as name_reference, description as name_description
+ | lookup local=t remote_access_software file_path OUTPUT app as path_signature, category as path_category, reference as path_reference, description as path_description
+ | eval signature=coalesce(nullif(name_signature, ""), path_signature),
+ category=coalesce(nullif(name_category, ""), path_category),
+ reference=coalesce(nullif(name_reference, ""), path_reference),
+ description=coalesce(nullif(name_description, ""), path_description)
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+
+ | `remote_access_software_usage_exceptions`
+
+ | `detect_remote_access_software_usage_registry_filter`
+how_to_implement: |-
+ The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
+ These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+ To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file.
+ These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+ The logs must also be mapped to the `Registry` node of the `Endpoint` data model.
+ Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+ The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
+known_false_positives: |-
+ Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the
+ remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -34,11 +103,11 @@ intermediate_findings:
- field: dest
type: system
score: 20
- message: A process for a known remote access software [$signature$] was detected on $dest$
+ message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$].
- field: user
type: user
score: 20
- message: A process for a known remote access software [$signature$] was detected on $dest$
+ message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$].
threat_objects:
- field: registry_path
type: registry_path
diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index 3403eef36a..59268a324d 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -1,8 +1,8 @@
name: Download Files Using Telegram
id: 58194e28-ae5e-11eb-8912-acde48001122
-version: 12
+version: 13
creation_date: '2021-05-07'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -47,6 +47,7 @@ analytic_story:
- XMRig
- Water Gamayun
- 0bj3ctivity Stealer
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1105
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 88b6fb4b74..7bdf159487 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -1,8 +1,8 @@
name: Executables Or Script Creation In Suspicious Path
id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 31
+version: 32
creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -141,6 +141,7 @@ analytic_story:
- Phantom Stealer
- Starland RAT Campaign
- Vidar Stealer
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1036
diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
index 69962abd69..70c7ca2f5d 100644
--- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
@@ -1,8 +1,8 @@
name: Executables Or Script Creation In Temp Path
id: e0422b71-2c05-4f32-8754-01fb415f49c9
-version: 27
+version: 28
creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -134,6 +134,7 @@ analytic_story:
- Salat Stealer
- Phantom Stealer
- Vidar Stealer
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1036
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 87b1884b1c..c358aafab6 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -1,8 +1,8 @@
name: Non Firefox Process Access Firefox Profile Dir
id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 21
+version: 22
creation_date: '2021-09-15'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -54,6 +54,7 @@ analytic_story:
- Salat Stealer
- Phantom Stealer
- Vidar Stealer
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1555.003
diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml
new file mode 100644
index 0000000000..2611e6247e
--- /dev/null
+++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml
@@ -0,0 +1,91 @@
+name: PowerShell Download from Code Hosting Service
+id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-13'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+ This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg.
+ These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
+ A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
+data_source:
+ - Powershell Script Block Logging 4104
+search: |-
+ `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *")
+ | where match(
+ ScriptBlockText,
+ "(?ix)
+ (?:
+ \.Download(?:File|Data|String)\s*\(\s*['\"]?
+ |
+ (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)
+ (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]?
+ |
+ Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]?
+ |
+ (?:curl|wget)\s+(?:-Uri\s+)?['\"]?
+ )
+ https?://
+ (?:
+ raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)*
+ |
+ (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+ |
+ codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+ )
+ \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi)
+ (?:[?#][^\s'\"]*)?
+ (?=['\"\s),;]|$)"
+ )
+ | fillnull
+ | stats count min(_time) as firstTime max(_time) as lastTime
+ by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `powershell_download_from_code_hosting_service_filter`
+how_to_implement: |-
+ To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted.
+ Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment.
+known_false_positives: |-
+ Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg.
+ Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action.
+references:
+ - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+ - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6
+drilldown_searches:
+ - name: View the detection results for - "$dest$"
+ search: '%original_detection_search% | search dest = "$dest$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+ - name: View risk events for the last 7 days for - "$dest$"
+ search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+ earliest_offset: 7d
+ latest_offset: "0"
+intermediate_findings:
+ entities:
+ - field: dest
+ type: system
+ score: 20
+ message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$].
+threat_objects: []
+analytic_story:
+ - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+ - T1059.001
+ - T1105
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log
+ source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+ sourcetype: XmlWinEventLog
+ test_type: unit
diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
index 48b6050197..6fa6786fe8 100644
--- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
@@ -1,8 +1,8 @@
name: Windows Boot or Logon Autostart Execution In Startup Folder
id: 99d157cb-923f-4a00-aee9-1f385412146f
-version: 17
+version: 18
creation_date: '2023-01-16'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -51,6 +51,7 @@ analytic_story:
- BlankGrabber Stealer
- Phantom Stealer
- Starland RAT Campaign
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1547.001
diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml
index 354d3e7a7d..24eb9e8c80 100644
--- a/detections/endpoint/windows_disable_or_stop_browser_process.yml
+++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml
@@ -1,8 +1,8 @@
name: Windows Disable or Stop Browser Process
id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5
-version: 15
+version: 16
creation_date: '2024-10-18'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: TTP
diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
index cc66fe2bfe..19d561e114 100644
--- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
+++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
@@ -1,8 +1,8 @@
name: Windows DNS Query Request To TinyUrl
id: b1ea79da-719c-437c-acaf-5c93f838f425
-version: 5
+version: 6
creation_date: '2021-11-18'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -22,7 +22,11 @@ search: |
"*\\ProgramData\\*",
"*\\Temp\\*",
"*\\Users\\Public\\*",
- "*\\Windows\\Tasks\\*"
+ "*\\Windows\\Tasks\\*",
+ "*\\powershell.exe",
+ "*\\pwsh.exe",
+ "*\\cmd.exe",
+ "*\\python.exe",
)
| stats count min(_time) as firstTime max(_time) as lastTime
by answer answer_count dvc process_exec process_guid process_name query query_count
@@ -58,6 +62,7 @@ threat_objects:
type: process_name
analytic_story:
- Malicious Inno Setup Loader
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1105
diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
index 7ad0eb58cc..c5294dd898 100644
--- a/detections/endpoint/windows_password_managers_discovery.yml
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -1,8 +1,8 @@
name: Windows Password Managers Discovery
id: a3b3bc96-1c4f-4eba-8218-027cac739a48
-version: 13
+version: 14
creation_date: '2022-12-06'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -55,6 +55,7 @@ analytic_story:
- Prestige Ransomware
- Scattered Spider
- Scattered Lapsus$ Hunters
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1555.005
diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
new file mode 100644
index 0000000000..20207c5a70
--- /dev/null
+++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
@@ -0,0 +1,107 @@
+name: Windows Process Outbound Connection To Social Media Domain
+id: d6dc231e-8595-499b-889e-cf6a055df4d4
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-06'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+ This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
+ It leverages Sysmon Event ID 3 to surface this anomalous behavior.
+ Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
+ For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
+data_source:
+ - Sysmon EventID 3
+search: |-
+ `sysmon`
+ EventCode=3
+ Image IN (
+ "*:\\$Recycle.Bin\\*",
+ "*:\\PerfLogs\\*",
+ "*:\\Users\\Administrator\\Music\\*",
+ "*:\\Users\\Public\\*",
+ "*:\\Windows\\Cursors\\*",
+ "*:\\Windows\\debug\\*",
+ "*:\\Windows\\fonts\\*",
+ "*:\\Windows\\INF\\*",
+ "*:\\Windows\\Media\\*",
+ "*:\\Windows\\Prefetch\\*",
+ "*\\Windows\\repair\\*"
+ )
+
+ process_name IN (
+ "py.exe",
+ "pypy.exe",
+ "python.exe",
+ "python2*.exe",
+ "python3*.exe",
+ "pythonw.exe"
+ )
+
+ dest IN (
+ "*.facebook.com",
+ "*.facebook.net",
+ "*.facebook.org",
+ "*.fb.com",
+ "*.fbcd.net",
+ "*.fbsbx.com",
+ "*.fbstatic-a.akamaihd.net",
+ "*.tfbw.net"
+ )
+ direction = outbound
+
+ | rename Image as process_path
+
+ | stats count min(_time) as firstTime
+ max(_time) as lastTime
+
+ by action app dest dest_ip dest_port direction dvc protocol protocol_version
+ process_path process_name process_guid process_id
+ src src_ip src_port transport user vendor_product
+
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `windows_process_outbound_connection_to_social_media_domain_filter`
+how_to_implement: |-
+ To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: |-
+ No false positives have been identified at this time.
+references:
+ - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+drilldown_searches:
+ - name: View the detection results for - "$src$"
+ search: '%original_detection_search% | search src = "$src$"'
+ earliest_offset: $info_min_time$
+ latest_offset: $info_max_time$
+ - name: View risk events for the last 7 days for - "$src$"
+ search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+ earliest_offset: 7d
+ latest_offset: "0"
+intermediate_findings:
+ entities:
+ - field: dest
+ type: system
+ score: 20
+ message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$]
+threat_objects:
+ - field: process_path
+ type: file_path
+analytic_story:
+ - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+ - T1586.001
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+ - name: True Positive Test
+ attack_data:
+ - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log
+ source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+ sourcetype: XmlWinEventLog
+ test_type: unit
diff --git a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
index e107f64a16..3f3e554f1b 100644
--- a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
+++ b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml
@@ -1,32 +1,68 @@
name: Cisco Secure Firewall - Communication Over Suspicious Ports
id: d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
-version: 8
+version: 9
creation_date: '2025-04-03'
-modification_date: '2026-05-13'
-author: Nasreddine Bencherchali, Splunk
+modification_date: '2026-10-08'
+author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |
- The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
+ The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities.
+ It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.
+ Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
data_source:
- Cisco Secure Firewall Threat Defense Connection Event
search: |
- `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url
- | stats min(_time) as firstTime max(_time) as lastTime
- values(src_port) as src_port
- values(url) as url
- values(rule) as rule
- count by src, dest, dest_port, transport, action
+ `cisco_secure_firewall`
+ EventType=ConnectionEvent
+ dest_port>1024
+ dest_port<49151
+
+ | where (
+ ```Same digit ports, i.e 4444, 55555```
+ (
+ isint(dest_port/1111)
+ AND dest_port<10000
+ )
+ OR
+ isint(dest_port/11111)
+
+ ```Ports with sequentially increasing digits, i.e 1234, 12345```
+ OR
+ (
+ isint((dest_port-123)/1111)
+ AND dest_port<7000
+ )
+ OR
+ isint((dest_port-1234)/11111)
+
+ ```Ports with sequentially decreasing digits, i.e 4321```
+ OR
+ (
+ isint((dest_port+123)/1111)
+ AND dest_port>4000
+ AND dest_port<10000
+ )
+ )
+
+ | fillnull value="unknown" url
+
+ | stats min(_time) as firstTime
+ max(_time) as lastTime
+ values(src_port) as src_port
+ values(url) as url
+ values(rule) as rule
+
+ count by src dest dest_port transport action
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___communication_over_suspicious_ports_filter`
how_to_implement: |
- This search requires Cisco Secure Firewall Threat Defense Logs, which
- includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
- We strongly recommend that you specify your environment-specific configurations
- (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
- with configurations for your Splunk environment. The search also uses a post-filter
- macro designed to filter out known false positives.
+ This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType.
+ This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs.
+ Replace the macro definition with configurations for your Splunk environment.
+ The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
The access policy must also enable logging.
The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment
@@ -50,7 +86,7 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: Suspicious communication detected from $src$ to $dest$ over port $dest_port$.
+ message: Suspicious communication detected from [$src$] to [$dest$] over port [$dest_port$].
threat_objects:
- field: url
type: url
diff --git a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
index d485b736f6..0f2e4a336e 100644
--- a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
+++ b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml
@@ -1,35 +1,51 @@
name: Cisco Secure Firewall - Connection to File Sharing Domain
id: f7e5e792-d907-46c1-a58e-4ff974dc462a
-version: 10
+version: 11
creation_date: '2025-04-03'
-modification_date: '2026-05-13'
+modification_date: '2026-10-08'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
- The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S).
+ The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains.
+ It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services.
+ While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads.
+ This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.
data_source:
- Cisco Secure Firewall Threat Defense Connection Event
-search: |
- `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*")
- | stats count min(_time) as firstTime max(_time) as lastTime
- Values(src_port) as src_port
- Values(dest) as dest
- Values(dest_port) as dest_port
- Values(rule) as rule
- Values(url) as url
- Values(EVE_Process) as EVE_Process
- by src, transport, action
+search: |-
+ `cisco_secure_firewall`
+ action IN ("Trust", "Allow", "allowed")
+ EventType=ConnectionEvent
+ [
+ | inputlookup file_sharing_domains_lookup
+ | table domain
+ | rename domain as url
+ ]
+
+ | lookup local=t file_sharing_domains_lookup domain as url OUTPUT description
+
+ | where match(url, "(?i)\b".description."\b")
+
+ | stats count min(_time) as firstTime
+ max(_time) as lastTime
+ values(src_port) as src_port
+ values(dest) as dest
+ values(dest_port) as dest_port
+ values(rule) as rule
+ values(url) as url
+ values(EVE_Process) as EVE_Process
+
+ by src transport action
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___connection_to_file_sharing_domain_filter`
how_to_implement: |
- This search requires Cisco Secure Firewall Threat Defense Logs, which
- includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
- We strongly recommend that you specify your environment-specific configurations
- (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
- with configurations for your Splunk environment. The search also uses a post-filter
- macro designed to filter out known false positives.
+ This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType.
+ This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+ with configurations for your Splunk environment.
+ The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
The access policy must also enable logging.
known_false_positives: |
@@ -52,7 +68,7 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: The host $src$ initiated a connection to the file sharing or pastebin domain $url$.
+ message: The host [$src$] initiated a connection to a file sharing or pastebin domain [$url$].
threat_objects:
- field: url
type: url
diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
index 8b32c0275e..2c00e8715b 100644
--- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
+++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml
@@ -1,48 +1,56 @@
name: Cisco Secure Firewall - Remote Access Software Usage Traffic
id: ac54d39e-a75d-4f42-971d-006db3a0423a
-version: 10
+version: 11
creation_date: '2025-05-28'
-modification_date: '2026-09-22'
-author: Nasreddine Bencherchali, Splunk
+modification_date: '2026-10-08'
+author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: |
- The following analytic detects network traffic associated with known remote access software applications
- that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
+description: |-
+ The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Cisco Secure Firewall Threat Defense Connection Event.
- This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
- If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
- data, or deploy additional malware, posing a severe threat to the organization's security.
data_source:
- Cisco Secure Firewall Threat Defense Connection Event
search: |
- `cisco_secure_firewall` EventType=ConnectionEvent
- | stats min(_time) as firstTime max(_time) as lastTime
- values(dest_port) as dest_port
- values(dest) as dest
- values(transport) as transport
- values(url) as url
- values(rule) as rule
- count by src ClientApplication action
+ `cisco_secure_firewall`
+ EventType=ConnectionEvent
+
+ [
+ | inputlookup remote_access_software
+ | search match_pattern!=""
+ | rename match_pattern as ClientApplication
+ | table ClientApplication
+ ]
+
+ | stats count min(_time) as firstTime
+ max(_time) as lastTime
+ values(dest_port) as dest_port
+ values(dest) as dest
+ values(transport) as transport
+ values(url) as url
+ values(rule) as rule
+
+ by src ClientApplication action
+
+ | lookup local=t remote_access_software match_pattern AS ClientApplication OUTPUT app as signature, category, reference, description
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description
- | search category IN ("remote administration", "remote desktop control")
+
| `remote_access_software_usage_exceptions`
+
| `cisco_secure_firewall___remote_access_software_usage_traffic_filter`
-how_to_implement: |
- This search requires Cisco Secure Firewall Threat Defense Logs, which
- includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
- We strongly recommend that you specify your environment-specific configurations
- (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
- with configurations for your Splunk environment. The search also uses a post-filter
- macro designed to filter out known false positives.
+how_to_implement: |-
+ This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType.
+ This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
+ with configurations for your Splunk environment.
+ The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
The access policy must also enable logging.
- The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions"
- that lets you track and maintain device- based exceptions for this set of detections.
-known_false_positives: |
- It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+ The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
+known_false_positives: |-
+ It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the
+ remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -61,7 +69,7 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: Traffic to known remote access software [$ClientApplication$] was detected from $src$.
+ message: Traffic associated with known remote access software [$ClientApplication$] was detected from [$src$].
threat_objects:
- field: ClientApplication
type: signature
diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index dc927f67a6..350fabadeb 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -1,35 +1,54 @@
name: Detect Remote Access Software Usage DNS
id: a16b797d-e309-41bd-8ba0-5067dae2e4be
-version: 15
+version: 16
creation_date: '2024-03-06'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-08'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly.
+description: |-
+ The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
data_source:
- Sysmon EventID 22
search: |
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
- from datamodel=Network_Resolution where
- DNS.query=*
- NOT DNS.query IN ("-", "unknown")
- by DNS.answer DNS.answer_count DNS.query
+
+ FROM datamodel=Network_Resolution WHERE
+
+ [
+ | inputlookup remote_access_software
+ | search domain!=""
+ | rename domain as DNS.query
+ | table DNS.query
+ ]
+
+ BY DNS.answer DNS.answer_count DNS.query
DNS.query_count DNS.reply_code_id DNS.src
DNS.vendor_product
+
| `drop_dm_object_name("DNS")`
+
+ | lookup local=t remote_access_software domain AS query OUTPUT app as signature, category, reference, description
+ | eval dest = query
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature,
- comment_reference as desc, category
- | eval dest = query
- | search isutility = True
+
| `remote_access_software_usage_exceptions`
+
| `detect_remote_access_software_usage_dns_filter`
-how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
-known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+how_to_implement: |-
+ To implement this search, you must ingest logs that contain the DNS query and the source of the query.
+ These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs.
+ The logs must also be mapped to the `Network_Resolution` data model.
+ Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+ The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
+known_false_positives: |-
+ It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with
+ any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv
+ lookup to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -52,7 +71,7 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: A domain for a known remote access software $query$ was contacted by $src$.
+ message: A domain [$query$] for a known remote access software [$signature$] was contacted by [$src$].
threat_objects:
- field: query
type: domain
diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml
index f088392075..ae4856160e 100644
--- a/detections/network/detect_remote_access_software_usage_traffic.yml
+++ b/detections/network/detect_remote_access_software_usage_traffic.yml
@@ -1,15 +1,14 @@
name: Detect Remote Access Software Usage Traffic
id: 885ea672-07ee-475a-879e-60d28aa5dd42
-version: 17
+version: 18
creation_date: '2024-03-06'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-08'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: |
+description: |-
The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
- If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
data_source:
- Palo Alto Network Traffic
search: |
@@ -18,24 +17,39 @@ search: |
max(_time) as lastTime
values(All_Traffic.dest_port) as dest_port
latest(All_Traffic.user) as user
- from datamodel=Network_Traffic where
- All_Traffic.app=*
- NOT All_Traffic.app IN ("-", "unknown")
- by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
+
+ FROM datamodel=Network_Traffic
+ WHERE
+ [
+ | inputlookup remote_access_software
+ | search match_pattern!=""
+ | rename match_pattern as All_Traffic.app
+ | table All_Traffic.app
+ ]
+
+ BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in
All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip
All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol
All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip
All_Traffic.src_port All_Traffic.transport All_Traffic.user
All_Traffic.vendor_product
| `drop_dm_object_name("All_Traffic")`
+
+ | lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category
- | search isutility = True
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_traffic_filter`
-how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
-known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+how_to_implement: |-
+ The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic
+ data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro
+ leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain
+ device- based exceptions for this set of detections.
+known_false_positives: |-
+ It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional
+ remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup
+ to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -59,11 +73,11 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: Application traffic for a known remote access software [$signature$] was detected from $src$.
+ message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$].
- field: user
type: user
score: 20
- message: Application traffic for a known remote access software [$signature$] was detected from $src$.
+ message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$].
threat_objects:
- field: signature
type: signature
diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml
index f05fb1a082..5a147a1253 100644
--- a/detections/network/http_post_request_with_encoded_payload.yml
+++ b/detections/network/http_post_request_with_encoded_payload.yml
@@ -2,14 +2,14 @@ name: HTTP POST Request with Encoded Payload
id: 0590881d-7b81-48dd-9674-1f23f7db5d40
version: 1
creation_date: '2026-10-12'
-modification_date: '2026-10-12'
-author: Raven Tait, Splunk
+modification_date: '2026-10-19'
+author: Raven Tait, Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
description: |-
- The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
- It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
- This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
+ The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings.
+ It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups.
+ This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
data_source:
- Zeek HTTP
search: |-
@@ -17,23 +17,37 @@ search: |-
method="POST"
post_body="*"
- | eval dest_port=coalesce(dest_port, 'id.resp_p'),
- dest=coalesce(dest, dest_ip, 'id.resp_h'),
- src=coalesce(src, src_ip, 'id.orig_h')
+ NOT orig_mime_type_first_stated IN (
+ "application/x-www-form-urlencoded",
+ "application/ocsp-request"
+ )
+
+ NOT user_agent IN (
+ "MicroMessenger Client",
+ "Dalvik*",
+ "AliPayWallet*"
+ )
- | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0)
- | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0)
+ | eval dest_port=coalesce(dest_port, 'id.resp_p'),
+ dest=coalesce(dest, dest_ip, 'id.resp_h'),
+ src=coalesce(src, src_ip, 'id.orig_h')
- | where _hex=1 OR _b64=1
+ | eval encoding=ltrim(if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ")
+ | eval encoding=ltrim(if(match(post_body, "(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ")
+ | eval encoding=ltrim(if(match(post_body, "(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ")
+ | eval encoding=ltrim(if(match(post_body, "(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ")
+ | eval encoding=ltrim(if(match(post_body, "(?:\\\\u[A-Fa-f0-9]{4}|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ")
+ | eval encoding=ltrim(if(match(post_body, "(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ")
- | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64")
+ | where encoding!=""
| stats count min(_time) as firstTime
max(_time) as lastTime
- values(encoding_type) as encoding_type
+ values(uri) as uri
+ values(encoding) as encoding
values(post_body) as post_body
- by src dest dest_port uri method status_code
+ by src dest dest_port method status_code
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -49,6 +63,7 @@ references:
- https://attack.mitre.org/techniques/T1071/001/
- https://attack.mitre.org/techniques/T1132/001/
- https://docs.zeek.org/en/master/logs/http.html
+ - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md
drilldown_searches:
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
@@ -63,7 +78,7 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$].
+ message: An HTTP POST request with an encoded body of type [$encoding$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$].
threat_objects:
- field: uri
type: uri
diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
index dc87224238..f1d6a09ed2 100644
--- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
+++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
@@ -1,8 +1,8 @@
name: Windows DNS Query Request by Telegram Bot API
id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e
-version: 12
+version: 13
creation_date: '2021-08-03'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -47,6 +47,7 @@ analytic_story:
- VIP Keylogger
- Phantom Stealer
- Starland RAT Campaign
+ - Braodo Stealer
asset_type: Endpoint
mitre_attack_id:
- T1071.004
diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml
index 228dd2e6a2..74856edc8c 100644
--- a/detections/web/detect_remote_access_software_usage_url.yml
+++ b/detections/web/detect_remote_access_software_usage_url.yml
@@ -1,18 +1,17 @@
name: Detect Remote Access Software Usage URL
id: 9296f515-073c-43a5-88ec-eda5a4626654
-version: 17
+version: 18
creation_date: '2024-03-06'
-modification_date: '2026-09-22'
-author: Steven Dick
+modification_date: '2026-10-08'
+author: Steven Dick, Onur Mustafa Erdogan, Splunk
status: production
type: Anomaly
-description: |
+description: |-
The following analytic detects the execution of known remote access software within the environment.
It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
- This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
data_source:
- Palo Alto Network Threat
-search: |
+search: |-
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
@@ -22,28 +21,42 @@ search: |
latest(Web.user) as user
latest(Web.dest) as dest
- from datamodel=Web where
+ FROM datamodel=Web WHERE
Web.url_domain=*
NOT Web.url_domain IN (
- "-",
- "unknown"
+ "-",
+ "unknown"
)
- by Web.action Web.src Web.category
+ [
+ | inputlookup remote_access_software
+ | search domain!=""
+ | rename domain as Web.url_domain
+ | table Web.url_domain
+ ]
+
+ BY Web.action Web.src Web.category
Web.url_domain Web.url_length
+ | `drop_dm_object_name("Web")`
+
+ | lookup local=t remote_access_software domain AS url_domain OUTPUT app as signature, category, reference, description
+
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
- | `drop_dm_object_name("Web")`
- | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference
- as desc, category
- | search isutility = True
+
| `remote_access_software_usage_exceptions`
+
| `detect_remote_access_software_usage_url_filter`
how_to_implement: |
- The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections.
+ The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons
+ that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to
+ normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well
+ as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.
known_false_positives: |
- It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content
+ It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional
+ remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup
+ to globally suppress these situations across all remote access content
references:
- https://attack.mitre.org/techniques/T1219/
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -66,11 +79,11 @@ intermediate_findings:
- field: src
type: system
score: 20
- message: A domain for a known remote access software $url_domain$ was contacted by $src$.
+ message: A domain for a known remote access software [$url_domain$] was contacted by [$src$].
- field: user
type: user
score: 20
- message: A domain for a known remote access software $url_domain$ was contacted by $src$.
+ message: A domain for a known remote access software [$url_domain$] was contacted by [$src$].
threat_objects:
- field: signature
type: signature
diff --git a/install.yml b/install.yml
index 28ef2c7679..cb3196171a 100644
--- a/install.yml
+++ b/install.yml
@@ -12,10 +12,10 @@ apps:
version: 2.3.4
- appid: Splunk_TA_stream
url: https://splunkbase.splunk.com/app/5238
- version: 8.1.6
+ version: 8.1.7
- appid: Splunk_TA_stream_wire_data
url: https://splunkbase.splunk.com/app/5234
- version: 8.1.6
+ version: 8.1.7
- appid: TA-Zscaler_CIM
url: https://splunkbase.splunk.com/app/3865
version: 4.1.5
diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv
index 25cf98922b..de28148840 100644
--- a/lookups/csv/detection_subcategory_map.csv
+++ b/lookups/csv/detection_subcategory_map.csv
@@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal
AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal
-Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal"
Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal"
Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml
index dbf0a875df..e6b1ec04cc 100644
--- a/lookups/csv/detection_subcategory_map.yml
+++ b/lookups/csv/detection_subcategory_map.yml
@@ -2,7 +2,7 @@ name: detection_subcategory_map
id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84
version: 3
creation_date: '2026-09-02'
-modification_date: '2026-10-13'
+modification_date: '2026-10-18'
author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team
lookup_type: csv
description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting.
diff --git a/lookups/csv/file_sharing_domains_lookup.csv b/lookups/csv/file_sharing_domains_lookup.csv
new file mode 100644
index 0000000000..cda6d83921
--- /dev/null
+++ b/lookups/csv/file_sharing_domains_lookup.csv
@@ -0,0 +1,103 @@
+domain,description
+*0bin.net*,0bin.net
+*1ty.me*,1ty.me
+*235523.xyz*,235523.xyz
+*8n1.org*,8n1.org
+*99paste.com*,99paste.com
+*anonfiles.com*,anonfiles.com
+*apaste.info*,apaste.info
+*beanpaste.fun*,beanpaste.fun
+*bin.bloerg.net*,bin.bloerg.net
+*bin.jarkon.fi*,bin.jarkon.fi
+*bin.lysator.liu.se*,bin.lysator.liu.se
+*bpa.st*,bpa.st
+*cl1p.net*,cl1p.net
+*clbin.com*,clbin.com
+*codebeautify.org*,codebeautify.org
+*codeshare.io*,codeshare.io
+*commie.io*,commie.io
+*controlc.com*,controlc.com
+*crypticbin.com*,crypticbin.com
+*cutapaste.net*,cutapaste.net
+*defuse.ca*,defuse.ca
+*dotnetfiddle.net*,dotnetfiddle.net
+*dpaste.com*,dpaste.com
+*everfall.com*,everfall.com
+*filebin.net*,filebin.net
+*fragbin.com*,fragbin.com
+*friendpaste.com*,friendpaste.com
+*ghostbin.co*,ghostbin.co
+*gistpad.com*,gistpad.com
+*glitch.me*,glitch.me
+*gofile.io*,gofile.io
+*hastebin.com*,hastebin.com
+*hastebin.dev*,hastebin.dev
+*ideone.com*,ideone.com
+*ivpaste.com*,ivpaste.com
+*jaw.gg*,jaw.gg
+*jpst.it*,jpst.it
+*jsbin.com*,jsbin.com
+*jsfiddle.net*,jsfiddle.net
+*jsitor.com*,jsitor.com
+*justpaste.it*,justpaste.it
+*justpaste.me*,justpaste.me
+*kpaste.net*,kpaste.net
+*lesma.eu*,lesma.eu
+*mediafire.com*,mediafire.com
+*mega.nz*,mega.nz
+*modernpaste.com*,modernpaste.com
+*n0paste.tk*,n0paste.tk
+*nekobin.com*,nekobin.com
+*nopaste.net*,nopaste.net
+*notes.io*,notes.io
+*p.ip.fi*,p.ip.fi
+*paste-bin.xyz*,paste-bin.xyz
+*paste.ax*,paste.ax
+*paste.centos.org*,paste.centos.org
+*paste.debian.net*,paste.debian.net
+*paste.ee*,paste.ee
+*paste.jp*,paste.jp
+*paste.js.org*,paste.js.org
+*paste.monster*,paste.monster
+*paste.myst.rs*,paste.myst.rs
+*paste.ofcode.org*,paste.ofcode.org
+*paste.opensuse.org*,paste.opensuse.org
+*paste.org.ru*,paste.org.ru
+*paste.rohitab.com*,paste.rohitab.com
+*paste.sh*,paste.sh
+*paste.strictfp.com*,paste.strictfp.com
+*paste2.org*,paste2.org
+*pastebin*,pastebin
+*pastecn.com*,pastecn.com
+*pastecode.io*,pastecode.io
+*pastecode.ru*,pastecode.ru
+*pasted.co*,pasted.co
+*pastee.dev*,pastee.dev
+*pastejustit.com*,pastejustit.com
+*pastelink.net*,pastelink.net
+*pastes.io*,pastes.io
+*pastesio.com*,pastesio.com
+*pastetext.net*,pastetext.net
+*pastey.gg*,pastey.gg
+*pastie.org*,pastie.org
+*primenotepad.com*,primenotepad.com
+*privatebin.net*,privatebin.net
+*privatlab*,privatlab
+*privnote.com*,privnote.com
+*quickhighlighter.com*,quickhighlighter.com
+*rentry.co*,rentry.co
+*send.exploit.in*,send.exploit.in
+*sendspace.com*,sendspace.com
+*snippet.host*,snippet.host
+*storjshare.io*,storjshare.io
+*temp.sh*,temp.sh
+*termbin.com*,termbin.com
+*textbin.net*,textbin.net
+*tny.cz*,tny.cz
+*transfer.sh*,transfer.sh
+*tutpaste.com*,tutpaste.com
+*ufile.io,ufile.io
+*vpaste.net*,vpaste.net
+*xi.pe*,xi.pe
+*zerobin.net*,zerobin.net
+*zigbin.io*,zigbin.io
\ No newline at end of file
diff --git a/lookups/csv/file_sharing_domains_lookup.yml b/lookups/csv/file_sharing_domains_lookup.yml
new file mode 100644
index 0000000000..7d199cea23
--- /dev/null
+++ b/lookups/csv/file_sharing_domains_lookup.yml
@@ -0,0 +1,11 @@
+name: file_sharing_domains_lookup
+id: 325e53a9-50be-4b00-be34-7925063b4278
+version: 1
+creation_date: '2019-10-06'
+modification_date: '2026-10-06'
+author: Splunk Threat Research Team
+lookup_type: csv
+description: A list of file sharing domains and pastebin-style hosting domains that can be modified
+match_type:
+ - WILDCARD(domain)
+case_sensitive_match: false
diff --git a/lookups/csv/remote_access_software.csv b/lookups/csv/remote_access_software.csv
index f8b8619427..e89d71867f 100644
--- a/lookups/csv/remote_access_software.csv
+++ b/lookups/csv/remote_access_software.csv
@@ -1,606 +1,2512 @@
-description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update
-Absolute (Computrace),*search.namequery.com,rpcnet.exe,Absolute Software*,absolute-manage,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
-Absolute (Computrace),*server.absolute.com,ctes.exe,Absolute Persistence*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
-Absolute (Computrace),,ctespersitence.exe,CTES*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
-Absolute (Computrace),,cteshostsvc.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
-Absolute (Computrace),,rpcld.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024
-Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
-Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
-Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024
-Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024
-Microsoft Quick Assist,remoteassistance.support.services.microsoft.com*,quickassist.exe,Quick Assist,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024
-MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
-MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024
-mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024
-MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024
-MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
-MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024
-N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*.beanywhere.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024
-NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
-NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
-NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024
-Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
-Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024
-Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024
-Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
-Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
-Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024
-NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
-NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
-NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024
-Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
-Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024
-Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
-Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024
-ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024
-NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024
-NinjaRMM,*.ninjarmm.com,NinjaRMMAgentPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,4/4/2025
-NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
-NoMachine,,nxservice*.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,4/4/2025
-NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024
-OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
-OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024
-Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
-Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024
-Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
-Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
-Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
-Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024
-pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
-pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
-pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024
-Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
-Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
-Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024
-Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
-Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
-Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
-Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024
-Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024
-Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024
-Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024
-Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
-Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024
-Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
-Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
-Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024
-PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
-PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024
-PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
-PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024
-PSEXEC (Clone),,csexec.exe,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024
-PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
-PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024
-PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
-PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024
-PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
-Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024
-QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
-QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
-QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024
-Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024
-RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
-RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
-RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024
-rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
-rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024
-RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024
-rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
-rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
-rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024
-Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
-Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
-Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024
-Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024
-Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
-Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024
-Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
-Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024
-Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
-Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
-Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024
-RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024
-RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
-RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
-RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024
-RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
-RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
-RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
-RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
-RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024
-RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
-RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
-RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
-RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024
-RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
-RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
-RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
-RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024
-Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
-Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024
-RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024
-RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024
-RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024
-RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
-RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024
-Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
-Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
-Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024
-ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
-ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
-ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024
-ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
-ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
-ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024
-SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
-SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
-SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
-SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024
-SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024
-SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024
-SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024
-Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
-Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
-Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024
-Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
-Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024
-Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024
-SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024
-247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024
-Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
-Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
-Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024
-Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
-Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
-Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024
-GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
-GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024
-GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024
-Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
-Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
-Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
-Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
-Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024
-Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024
-HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024
-HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024
-HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
-HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024
-I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
-I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
-I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024
-Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
-Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
-Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
-Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024
-IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
-IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
-IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
-IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
-IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024
-Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
-Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
-Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024
-ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
-ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
-ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
-ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024
-Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024
-ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024
-Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
-Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
-Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
-Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024
-Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024
-Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
-Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
-Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024
-KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
-KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024
-LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
-LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
-LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
-LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
-LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024
-Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024
-Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024
-Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
-Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
-Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024
-LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
-LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
-LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
-LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024
-LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024
-LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
-LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
-LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024
-Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024
-MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024
-Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024
-Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024
-Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024
-Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024
-Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024
-Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
-Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
-Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
-Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024
-AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
-AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024
-AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
-AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024
-Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
-Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024
-Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
-Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024
-AnyDesk,*net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
-AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024
-Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024
-AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
-AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
-AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024
-Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
-Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
-Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024
-Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
-Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024
-AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
-AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024
-Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
-Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
-Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024
-Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024
-BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
-BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024
-BeAnyWhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024
-BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
-BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
-BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
-BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
-BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024
-CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
-CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024
-Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024
-Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
-Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024
-CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024
-Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
-Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024
-CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
-CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
-CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024
-CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
-CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024
-CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024
-Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-Dameware,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-Dameware,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-Dameware,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-Dameware,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024
-DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
-DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024
-Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024
-DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
-DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
-DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024
-Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024
-Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024
-Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024
-EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024
-Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024
-Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
-Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
-Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024
-ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
-ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
-ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
-ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
-ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024
-ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
-ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
-ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024
-FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
-FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
-FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024
-FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024
-FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
-FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
-FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
-FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
-FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024
-Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024
-GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
-GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
-GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024
-GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
-GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024
-GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024
-Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
-Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
-Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
-Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024
-Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
-Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
-Pandora RC (eHorus),,ehorus_launcher.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
-Pandora RC (eHorus),,ehorus_display.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024
-ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
-ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
-ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024
-ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
-ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
-ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024
-ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
-ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024
-Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
-Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
-Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
-Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
-Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024
-SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
-SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
-SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
-SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
-SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024
-Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
-Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
-Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024
-Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024
-Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
-Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024
-Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
-Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
-Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
-Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024
-Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
-Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024
-Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
-Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
-Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
-Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024
-BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
-BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024
-DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024
-DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
-DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024
-DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
-DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024
-Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
-Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024
-KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
-KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024
-MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024
-NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024
-OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
-OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024
-PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
-PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024
-SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
-SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
-SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024
-Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024
-Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
-Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024
-TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
-TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024
-Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024
-Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
-Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
-Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024
-Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
-Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024
-Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
-Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
-Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024
-Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
-Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
-Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
-Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
-Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024
-TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
-TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
-TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
-TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
-TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024
-TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
-TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
-TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024
-TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
-TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
-TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024
-ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024
-ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
-ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024
-TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
-TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
-TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024
-UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
-UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
-UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
-UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024
-UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024
-VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024
-WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024
-WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024
-Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
-Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
-Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024
-Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
-Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024
-Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024
-ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
-ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
-ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024
-Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,zoho-assist,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zoho.eu,zaservice.exe,,zoho-assist-base,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024
-Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
-Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
-Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
-Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
-Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024
-Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,*.nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024
-Syncro,app.kabuto.io,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024
-Devolutions Remote Desktop Manager,*cloud.devolutions.net,RemoteDesktopManager*.exe,Devolutions inc,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025
-Devolutions Remote Desktop Manager,*api.devolutions.com,Devolutions.Updater.exe,Remote Desktop Manager,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025
-Devolutions Remote Desktop Manager,*telemetry2.devolutions.net,,,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025
-Koofr,*app.koofr.net,storagegui.exe,koofr*,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025
-Koofr,,storagechrome.exe,,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025
-MEGA Sync,*mega.co.nz,MEGAsyncSetup*.exe,MEGA Limited,mega-base,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025
-MEGA Sync,*api.mega.co.nz,Megasync.exe,MEGAsync,mega-chat,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025
-MEGA Sync,*mega.nz,MegaUpdater.exe,,,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025
-NordLocker,*cloud.nordlocker.com,nordlockersetup*.exe,nordvpn*,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025
-NordLocker,*.nordcdn.com,NordLocker.exe,NordLocker,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025
-NordLocker,*auth.nordlocker.com,NordUpdateService.exe,NordSec Update Service,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025
-Total Software Deployment,*.softinventive.com,tsd-setup.exe,SoftInventive Lab,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025
-Total Software Deployment,,tsd.exe,Total Software Deployment,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025
-Yandex Disk,*disk.yandex.run,YandexDisk*Setup.exe,Yandex LLC,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025
-Yandex Disk,*cloud-api.yandex.net,YandexDisk2.exe,Yandex.Disk,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025
-Yandex Disk,*yastatic.net,YandexNotes.exe,Yandex,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025
-Yandex Disk,passport.yandex.com,,,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025
-Glance,screenshare-location.glance.net,GlanceSetup*.exe,GlanceClient*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024
-Glance,s*.glance.net,GlanceGuestSetup*.exe,GlanceLauncher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024
-Glance,pr*.glance.net,Glance.exe,Glance Setup*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024
-Glance,,GlanceLauncher.exe,Glance Launcher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024
-Glance,,GProtocolHandler.exe,Glance Networks*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024
-Microsoft SCCM Remote Control,user_managed,sccmrdpsystem.exe,SCCM RDP System,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025
-Microsoft SCCM Remote Control,,sccmrdpuser.exe,Microsoft Configuration Manager Remote Control,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025
-Microsoft SCCM Remote Control,,cmrcservice.exe,Configuration Manager Remote Control Service,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025
-Microsoft SCCM Remote Control,,cmrcviewer.exe,ConfigMgr Remote Control Viewer,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025
-NexThink,*.data.us.nexthink.cloud,nxtsvc.exe,Nexthink Collector*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025
-NexThink,*.data.eu.nexthink.cloud,nxtcod.exe,Nexthink Coordinator*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025
-NexThink,*.data.pac.nexthink.cloud,nxtcoordinator.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025
-NexThink,*.data.meta.nexthink.cloud,nxtupdater.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025
+app,"match_pattern",domain,"file_path","file_name","file_info",category,reference,description
+"247ithelp.com (ConnectWise)","247ithelp.com*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"247ithelp.com (ConnectWise)","ConnectWise*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"247ithelp.com (ConnectWise)",,"*.247ithelp.com",,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"247ithelp.com (ConnectWise)",,,,"Remote Workforce Client.exe",,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)","Absolute*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)","Computrace*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,"*.search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,"*.server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,"search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,"server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,"ctes.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,"cteshostsvc.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,"ctespersistence.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,"rpcld.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,"rpcnet.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,,"Absolute Persistence*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,,"CTES*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Absolute (Computrace)",,,,,"Absolute Software*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Access Remote PC","Access Remote PC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Access Remote PC","AccessRemotePC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Access Remote PC",,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)","Acronis Cyber Protect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)","AcronisCyberProtect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)","Remotix*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,"agents*-cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,"cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,"connect.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,"gw.remotix.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectAgent.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectQuickAssist*.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Agent",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Quick Assist",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Action1,"Action1*",,,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed."
+Action1,,"*.action1.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed."
+Action1,,"a1-backend-packages.s3.amazonaws.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed."
+Action1,,,"C:\Windows\Action1\*",,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed."
+Action1,,,,,"Action1*",RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed."
+Addigy,"Addigy*",,,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Addigy,,"agents.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Addigy,,"grtmprod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Addigy,,"prod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Addigy,,,,"addigy-*.pkg",,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Addigy,,,,,"Addigy*",RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,"AeroAdmin*",,,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,"aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,"auth*.aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,,,"AeroAdmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,,,"aeroadmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,,,,"Aero Admin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AeroAdmin,,,,,"AeroAdmin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"AliWangWang-remote-control","AliWangWang-remote-control*",,,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"AliWangWang-remote-control",,"wangwang.taobao.com",,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"AliWangWang-remote-control",,,,"alitask.exe",,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"AliWangWang-remote-control",,,,,"AliWangWang*",RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Allocentra,"Allocentra*",,,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions."
+Allocentra,,"api.allocentra.co.za",,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions."
+Allocentra,,,"C:\Program Files\Allocentra\Agent\allocentra-agent.exe",,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions."
+Allocentra,,,,"allocentra-agent.exe",,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions."
+Alpemix,"Alpemix*",,,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,"*.alpemix.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,"*.teknopars.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,,"C:\AlpemixService.exe",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,,"C:\AlpemixSrvc\",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,,,,"Teknopars*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Alpemix,,,,,"Alpemix*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support","Any Support*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support","AnySupport*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support",,"*.anysupport.net",,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support",,,,"ManualLauncher.exe",,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support",,,,,"Koino Co.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support",,,,,"Ltd.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Any Support",,,,,"AnySupport*",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyDesk,"AnyDesk*",,,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,"*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,"boot.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,"relay-*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"/Applications/AnyDesk.app",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files (x86)\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files (x86)\AnyDesk\AnyDesk.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,"C:\Program Files\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,,anydesk.exe,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,,,"philandro Software*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyDesk,,,,,"anydesk*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams."
+AnyViewer,"AnyViewer*",,,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyViewer,,"*.anyviewer.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyViewer,,"*.aomeisoftware.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyViewer,,,"C:\Program Files (x86)\AnyViewer\*",,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyViewer,,,,,"Anyviewer*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AnyViewer,,,,,"AOMEI*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Anyplace Control","Anyplace Control*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Anyplace Control","AnyplaceControl*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Anyplace Control",,"anyplace-control.com",,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Anyplace Control",,,,"apc_host.exe",,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Anyplace Control",,,,,"Anyplace*",RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Aspia,"Aspia*",,,,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool."
+Aspia,,,"*\aspia_client.exe",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool."
+Aspia,,,"C:\Program Files (x86)\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool."
+Aspia,,,"C:\Program Files\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool."
+Atera,"Atera*",,,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"agent-api.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"agenthb.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"agentreporting.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"agentreportingstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"app.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"appcdn.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"atera-agent-heartbeat.servicebus.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"atera.pubnubapi.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"getalphacontrol.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"packagesstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"ps.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,"pubsub.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"*\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"*\AgentPackageNetworkDiscovery.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"*\AgentPackageTaskScheduler.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"*\AteraAgent.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"C:\Program Files (x86)\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"C:\Program Files\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,"C:\Program Files\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,,"atera_agent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,,"ateraagent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,,"syncrosetup.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,,,AteraAgent,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Atera,,,,,"Atera Networks",RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement."
+Auvik,"Auvik*",,,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Auvik,,"*.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Auvik,,"*.my.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Auvik,,"auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Auvik,,,,"auvik.agent.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Auvik,,,,"auvik.engine.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,"AweRay*",,,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,"asapi*.aweray.net",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,"client-api.aweray.com",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,,,"AweSun.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,,,"aweray_remote*.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,,,,"AweSun*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+AweRay,,,,,"AweRay*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,"Barracuda*",,,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,"*.islonline.net",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,"barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,"rmm.barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,,,,"Barracuda Networks",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,,,,"LPI Level Platforms",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Barracuda,,,,,"Barracuda MSP",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Basecamp,"Basecamp*",,,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Basecamp,,"basecamp.com",,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Basic RMM Agent","Basic RMM Agent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage."
+"Basic RMM Agent","BasicRMMAgent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage."
+BeAnyWhere,"BeAnyWhere*",,,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,"beanywhere.com",,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"BASupApp.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"BASupAppElev.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"BASupAppSrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"BASupSysInf.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"TakeControl.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"basupsrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"basupsrvcupdate.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeAnyWhere,,,,"basuptshelper.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,"BeInSync*",,,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,,"*.beinsync.com",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,,"*.beinsync.net",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,,,,"Beinsync*.exe",,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,,,,,"BeInSync Client GUI",RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeInSync,,,,,BeInSync,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Beacon (Synertek)","Beacon*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)","Synertek*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/Library/Application Support/Beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/Library/Application Support/Beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/Library/LaunchDaemons/com.beacon.agent.plist",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/etc/beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/etc/beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/etc/systemd/system/beacon-agent.service",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/usr/local/bin/beacon-agent",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"/var/log/beacon-agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"C:\Program Files\Beacon\beacon-agent.exe",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"C:\ProgramData\Beacon\agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+"Beacon (Synertek)",,,"C:\ProgramData\Beacon\credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+BeamYourScreen,"BeamYourScreen*",,,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeamYourScreen,,"*.beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeamYourScreen,,"beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeamYourScreen,,,,"beamyourscreen-host.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeamYourScreen,,,,"beamyourscreen.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeamYourScreen,,,,,"BeamYourScreen*",RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+BeyondTrust,"BeyondTrust*",,,,,RMM,"","BeyondTrust is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)","BeyondTrust*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)","Bomgar*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,"*.beyondtrustcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,"*.bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,"bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,"bomgar-pac-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,"bomgar-pac.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,"bomgar-rdp.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,"bomgar-scc-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,"bomgar-scc.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,,"Bomgar*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BeyondTrust (Bomgar)",,,,,"BeyondTrust*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"BlackCrypt RMM Agent","BlackCrypt RMM Agent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"BlackCrypt RMM Agent","BlackCryptRMMAgent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"BlackCrypt RMM Agent",,"blackcryptknight.com",,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+Borealis,"Borealis*",,,,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/etc/systemd/system/borealis-agent-updater.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/etc/systemd/system/borealis-agent-watchdog.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/etc/systemd/system/borealis-agent.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/opt/Borealis/Agent/Agent",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/opt/Borealis/Agent/Logs/Agent/agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"/opt/Borealis/Agent/agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"C:\Borealis\*",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"C:\Borealis\Logs\Agent\agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Borealis,,,"C:\Borealis\agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+BreezeRMM,"BreezeRMM*",,,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,"breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,"breezermm.com",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,"eu.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,"us.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/Application Support/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-loginwindow.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-user.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.agent.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.watchdog.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/Library/Logs/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/etc/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/etc/systemd/system/breeze-agent.service",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/usr/local/bin/breeze-agent",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/usr/local/bin/breeze-backup",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/usr/local/bin/breeze-desktop-helper",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/usr/local/bin/breeze-watchdog",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/var/lib/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"/var/log/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"C:\Program Files\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,"C:\ProgramData\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+BreezeRMM,,,,"PixoIT-agent.exe",,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established."
+"CHAOS RAT","CHAOS RAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use."
+"CHAOS RAT","CHAOSRAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use."
+"CentraStage (Datto)","CentraStage*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)","Datto*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,"*.cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,"*.rmm.datto.com",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,"cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,,,"AEMAgent.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,,,"CagService.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CentraStage (Datto)",,,,,"Datto*",RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Centurion,"Centurion*",,,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Centurion,,"centuriontech.com",,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Centurion,,,,"ctiserv.exe",,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Chicken (of the VNC)","Chicken*",,,,,RAT,"https://github.com/flit/cotvnc","Chicken (of the VNC) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Chrome Remote Desktop","Chrome Remote Desktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop","ChromeRemoteDesktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"*.remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"*.remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"chromoting-client.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"chromoting-host.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"chromoting-oauth.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,"remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"*\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"*\remoting_host.exe",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,"C:\Program Files (x86)\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,,"remoting_host.exe",,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome Remote Desktop",,,,,"Chrome Remote Desktop",RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context."
+"Chrome SSH Extension","Chrome SSH Extension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Chrome SSH Extension","ChromeSSHExtension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Chrome SSH Extension",,,"*Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Chrome SSH Extension",,,"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CloudFlare Tunnel","CloudFlare Tunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel","CloudFlareTunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"*.cfargotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"*.trycloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"_v2-origintunneld._tcp.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"api.cloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"h2.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"quic.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"update.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"us-region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,"us-region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,,"C:\Program Files (x86)\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,,"C:\Program Files\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"CloudFlare Tunnel",,,,"cloudflared.exe",,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it."
+"Comodo RMM","Comodo RMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM","ComodoRMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,"*.mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,"one.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,,,"itsmagent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Comodo RMM",,,,"rviewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,"ConnectWise*",,,,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,,,"*\ScreenConnect*Client*\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,,,,,"ScreenConnect*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ConnectWise,,,,,"ConnectWise*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control","ConnectWise Control*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control","ConnectWiseControl*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,"control.connectwise.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,"live.screenconnect.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,"connectwisechat-customer.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,"connectwisecontrol.client.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,"screenconnect.windowsclient.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,,"ScreenConnect*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ConnectWise Control",,,,,"ConnectWise*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)","Connectwise Automate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)","ConnectwiseAutomate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)","LabTech*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)",,"*.hostedrmm.com",,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)",,,,"ltsvc.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)",,,,"ltsvcmon.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Connectwise Automate (LabTech)",,,,"lttray.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ControlR,"ControlR*",,,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,"demo.controlr.app",,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"/Applications/ControlR.*.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"/Applications/ControlR.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"/Library/Application Support/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"/usr/local/bin/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"C:\Program Files\ControlR\*\ControlR.Agent.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.dll",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+ControlR,,,"C:\ProgramData\ControlR\",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems."
+Controlio,"Controlio*",,,,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,"C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\",,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"bbl.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"libeay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"ssleay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"weCliboardListener.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"weInstSvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"wec_launcher_[a-Z0-9]*_.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"wec_launcher_[a-Z0-9]*_.pkg",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"wemonc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"weprtct.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+Controlio,,,,"wesvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+CrossLoop,"CrossLoop*",,,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,"*.crossloop.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,"crossloop.en.softonic.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,,,"CrossLoopConnect.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,,,"WinVNCStub.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,,,"crossloopservice.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+CrossLoop,,,,,"Crossloop*",RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"CrossTec Remote Control","CrossTec Remote Control*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"CrossTec Remote Control","CrossTecRemoteControl*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"CrossTec Remote Control",,,,"PCIVIDEO.EXE",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"CrossTec Remote Control",,,,"supporttool.exe",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"CrossTec Remote Control",,,,,CrossTec,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+CruzControl,"CruzControl*",,,,,RMM,"https://resources.doradosoftware.com/cruz-rmm","CruzControl is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service","DW Service*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service","DWService*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service",,"*.dwservice.net",,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service",,,,"dwagent.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service",,,,"dwaglnc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service",,,,"dwagsvc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"DW Service",,,,,"DWSNET*",RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,"DameWare*",,,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,"dameware.com",,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,"*\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,"*\dwrcst.exe",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,"C:\Program Files\SolarWinds\Dameware Mini Remote Control\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,"C:\Windows\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"DameWare Mini Remote Control*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"DameWare Remote Support.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"SolarWinds-Dameware-DRS*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"SolarWinds-Dameware-MRC*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"dntus*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,"dwrcs.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DameWare,,,,,"DameWare*",RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Dataplicity,"Dataplicity*",,,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,"*.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,"*.wormhole.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,"dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,"www.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,,"/etc/init.d/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,,"/etc/systemd/system/dataplicity.service",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,,"/opt/dataplicity/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,,"/opt/dataplicity/tuxtunnel/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+Dataplicity,,,"/usr/local/bin/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile."
+DeskDay,"DeskDay*",,,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskDay,,"app.deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskDay,,"deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskDay,,,,"ultimate_*.exe",,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskNets,"DeskNets*",,,,,RMM,"https://www.desknets.com/en/download.html","DeskNets is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskShare,"DeskShare*",,,,,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskShare,,,,"DSGuest.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskShare,,,,"TeamTaskManager.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskShare,,,,,"DeskShare*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DeskShare,,,,,"Team Task Manager*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DesktopNow,"DesktopNow*",,,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DesktopNow,,"*.nchuser.com",,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DesktopNow,,,,"desktopnow.exe",,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DesktopNow,,,,,"NCH Software*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DesktopNow,,,,,"DesktopNow*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Dev Tunnels (aka Visual Studio Dev Tunnel)","Dev Tunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Dev Tunnels (aka Visual Studio Dev Tunnel)","DevTunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Dev Tunnels (aka Visual Studio Dev Tunnel)","aka Visual Studio Dev Tunnel*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager","Devolutions Remote Desktop Manager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager","DevolutionsRemoteDesktopManager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager",,,"*\RemoteDesktopManager.exe",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager",,,"C:\Program Files\Devolutions\Remote Desktop Manager",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager",,,,,"Remote Desktop Manager",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Devolutions Remote Desktop Manager",,,,,"Devolutions inc",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop","Distant Desktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop","DistantDesktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,"*.distantdesktop.com",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,"*.signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,"signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,"dd.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,"ddsystem.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,"distant-desktop.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,,"Distant Desktop*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,,"German Gorodokuplya*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Distant Desktop",,,,,"Distant Software*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,"Domotz*",,,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,"*.cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,"*.domotz.co",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,"cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,"domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"Domotz Pro Desktop App Setup*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"Domotz Pro Desktop App.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"domotz*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"domotz-windows*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"domotz.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,"domotz_bash.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Domotz,,,,,"Domotz*",RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DragonDisk,"DragonDisk*",,,,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DragonDisk,,,"*\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DragonDisk,,,"*\DragonDisk.exe",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+DragonDisk,,,"C:\Program Files (x86)\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Duet Display","Duet Display*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display","DuetDisplay*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,"*.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,"*.itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,"duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,"itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,"rdp.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,,,"DuetDisp.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,,,"DuetSetup.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+"Duet Display",,,,"duet.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose."
+Duplicati,"Duplicati*",,,,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Duplicati,,,"*\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Duplicati,,,"c:\Program Files\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"EMCO Remote Console","EMCO Remote Console*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"EMCO Remote Console","EMCORemoteConsole*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"EMCO Remote Console",,"emcosoftware.com",,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"EMCO Remote Console",,,,"remoteconsole.exe",,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator","ESET Remote Administrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator","ESETRemoteAdministrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,"ERAAgent.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,"einstaller.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,"era.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,"eratool.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,"ezhelp*.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ESET Remote Administrator",,,,,"ESET Management*",RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Echoware,"Echoware*",,,,,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Echoware,,,,"echoserver*.exe",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Echoware,,,,"echoware.dll",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Electric AI (Kaseya)","Electric AI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Electric AI (Kaseya)","ElectricAI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Electric AI (Kaseya)",,"electric.ai",,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Encapto,"Encapto*",,,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Encapto,,"encapto.com",,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Endar,"Endar*",,,,,RMM,"https://github.com/tomkeene/endar,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/README.md,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/app/agent_api_v1/views.py,https://github.com/tomkeene/endar/releases/tag/1.0.0,https://github.com/tomkeene/endar/releases/download/1.0.0/endar.exe","Endar is an open-source, self-hosted RMM platform focused on endpoint monitoring and compliance policies. Its controller source exposes agent registration, policy retrieval, compliance-result, and data-collection endpoints. Static extraction of the sole GitHub 1.0.0 release asset identifies a Linux x86-64 PyInstaller endpoint agent with registration, policy, data-collection, and compliance-task code. The source for that agent is not in the repository, and the asset does not establish a default installation directory or service; this entry records only supported release evidence."
+"Ericom AccessNow","Ericom AccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom AccessNow","EricomAccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom AccessNow",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom AccessNow",,,,"accessserver*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom AccessNow",,,,"accessserver.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom Connect","Ericom Connect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom Connect","EricomConnect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom Connect",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom Connect",,,,"EricomConnectRemoteHost*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ericom Connect",,,,"ericomconnectconfigurationtool.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ExtraPuTTY,"ExtraPuTTY*",,,,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ExtraPuTTY,,,"*Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ExtraPuTTY,,,"*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ExtraPuTTY,,,"C:\Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Faronics Core","Faronics Core*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core","FaronicsCore*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,"faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\CoreAgentService.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\FaronicsCoreAgent.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"C:\Program Files (x86)\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"C:\Program Files\Faronics\Core\Console\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\Workstation Agent\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,"C:\ProgramData\Faronics\FCAForStartupMonitor.msi",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,,"CoreAgentService.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Core",,,,"FaronicsCoreAgent.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze","Faronics Deep Freeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze","FaronicsDeepFreeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"cloud.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"www.deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFC.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServ.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServEx.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFWks.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-1\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"C:\Program Files\Faronics Corporation\Deep Freeze 7.00\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,"C:\Program Files\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFC.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFInst.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFServ.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFServEx.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFStd.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFStdInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deep Freeze",,,,"DFWks.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151."
+"Faronics Deploy","Faronics Deploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy","FaronicsDeploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"1wuccjc4a3.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"29qoj3q0yf.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"deploy.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"nv0mddxkh7.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-ap-southeast-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-ca-central-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-eu-west-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-sa-east-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-us-east-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"remotepro-us-west-2.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,"www.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,"C:\ProgramData\Faronics\StorageSpace\FWA\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,,"FWAService.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,,"FWAWebInstaller_*.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,,"FWA_UI_Agent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Deploy",,,,"FaronicsDeployAgent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution."
+"Faronics Insight","Faronics Insight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight","FaronicsInsight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,"faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentAgent.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentSvc.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentUI.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"*\Faronics\Insight Student\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"*\Faronics\Insight Teacher\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"C:\Program Files\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,"C:\Program Files\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"FIStudentAgent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"FIStudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"FIStudentUI.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"InsightInstaller.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"InsightInstallerStudent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"InsightInstallerTeacher.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"InsightSetup.msi",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"STAHelper.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+"Faronics Insight",,,,"StudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151."
+FastViewer,"FastViewer*",,,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,"*.fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,"fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,,,"FastViewer.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,,,"fastclient.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,,,"fastmaster.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FastViewer,,,,,"Fastviewer*",RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it","FixMe.it*",,,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,"*.fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,"*.techinline.net",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,"fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,9380CC75B872221A7425D7503565B67580407F60,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"FixMeit Client.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"FixMeit Expert Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"FixMeit Unattended Access Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"FixMeitClient*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"TiClientCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"TiClientHelper*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"TiExpertCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"TiExpertStandalone.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,"fixmeitclient.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,,"FixMe.IT Helper",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,,"SetMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FixMe.it",,,,,"FixMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"FleetDeck.io","FleetDeck.io*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,"*.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,"agentmqtt.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,"checkip.zmazonaws.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,"fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,"C:\Windows\Temp\FleetDeck\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck-agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck-agent.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck-agent.mst",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck_agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck_agent_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck_commander_launcher.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck_commander_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,"fleetdeck_installer.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+"FleetDeck.io",,,,,"FleetDeck*",RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations."
+Fortra,"Fortra*",,,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Fortra,,"fortra.com",,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Ping Tool","Free Ping Tool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Ping Tool","FreePingTool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Ping Tool",,,,"can't find this one",,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Tools Launcher","Free Tools Launcher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Tools Launcher","FreeToolsLauncher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Tools Launcher",,,"*\ManageEngine\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Free Tools Launcher",,,"C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FreeNX,"FreeNX*",,,,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FreeNX,,,"*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+FreeNX,,,"C:\*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Freshservice,"Freshservice*",,,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshcloud.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshconnect.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.freshworksapi.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.in-freshbots.ai",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.myfreshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.rtschannel.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"*.webpush.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"api.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"apicdn-wchat.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"fstools.freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"fstools.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"static.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,"www.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"*\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"*\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"*\FSWmiScanner.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"*\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"*\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\plink.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\db\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\nmap\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\tools\ssh\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,,"FSAgent.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,,"fs-probe-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,,"fs-windows-agent-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+Freshservice,,,,"win-installer-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services."
+"GLPI Agent","GLPI Agent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent","GLPIAgent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"forum.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"nightly.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"services.glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,"www.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/Applications/GLPI-Agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/Applications/GLPI-Agent/etc/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/etc/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/usr/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/usr/local/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"/var/lib/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"C:\Program Files\GLPI-Agent\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"C:\Program Files\GLPI-Agent\etc\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"C:\Program Files\GLPI-Agent\logs\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"C:\Program Files\GLPI-Agent\perl\bin\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GLPI Agent",,,"C:\Program Files\GLPI-Agent\var\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers."
+"GO RMM","GO RMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse."
+"GO RMM","GORMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse."
+"GatherPlace-desktop sharing","GatherPlace-desktop sharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing","GatherPlace-desktopsharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,"*.gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,"*.gatherplace.net",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,"gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,,,"gp3.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,,,"gp4.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,,,"gp5.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GatherPlace-desktop sharing",,,,,"Gatherworks*",RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GetScreen,"GetScreen*",,,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"GetScreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"go.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"image.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,"px-*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,"C:\Program Files\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,"C:\ProgramData\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,"C:\Users\*\AppData\Local\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,"C:\Users\*\Downloads\getscreen-x86.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,"C:\Users\*\Downloads\getscreen.upd.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,,,"Point B Ltd*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+GetScreen,,,,,"getscreen.me*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""."
+"Go Mini RMM","Go Mini RMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product."
+"Go Mini RMM","GoMiniRMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product."
+"GoTo Opener","GoTo Opener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoTo Opener","GoToOpener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoTo Opener",,,"*\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoTo Opener",,,"C:\Program Files (x86)\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,"GoToAssist*",,,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.cdn.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.desktopstreaming.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.fastsupport.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.gotoassist.at",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.gotoassist.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"*.gotoassist.me",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"goto.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,"helpme.net",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"GoTo Assist Opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"g2a*.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"g2ax_comm_customer.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"g2mcomm.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"g2mupdate.com",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"goto opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,"gotoassist.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToAssist,,,,,"GoToAssist*",RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoToAssist (GoTo Resolve)","GoTo Resolve*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)","GoToAssist*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,"C:\Program Files (x86)\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,"C:\Program Files\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveExternalModuleHandler.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveFileManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveLoggerProcess.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveNetworkChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveProcessChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveQuickView.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveRegistryEditor.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveRemoteControl.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveService.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveServiceManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveTerminal.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools32.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools64.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattended.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedRemover.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist (GoTo Resolve)",,,,,"GoToAssist*",RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform."
+"GoToAssist Agent Desktop Console","GoToAssist Agent Desktop Console*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoToAssist Agent Desktop Console","GoToAssistAgentDesktopConsole*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoToAssist Agent Desktop Console",,,"*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GoToAssist Agent Desktop Console",,,"C:\*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,"GoToMyPC*",,,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,"*.GoToMyPC.com",,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,,"%APPDATA%\GoToMeeting\G2M.exe",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,,"C:\Program Files (x86)\GoToMyPC\*",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,,,"G2M.exe",,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,,,,GoToOpener,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GoToMyPC,,,,,"GoTo Opener",RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Gorelo RMM","Gorelo RMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM","GoreloRMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"app.gorelo.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"gorelo-rmm.azurewebsites.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"gw.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"lr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"public.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"r1.rmm.uw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+"Gorelo RMM",,"sr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration."
+GotoHTTP,"GotoHTTP*",,,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,"*.gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,"gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,,,"GotoHTTP*.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,,,"GotoHTTP_x64.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,,,"gotohttp.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,,,,"Pingbo*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+GotoHTTP,,,,,"GotoHTTP*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,"Goverlan*",,,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,"goverlan.com",,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,"*\GovSrv.exe",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,"*\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,"C:\Program Files (x86)\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,"GovAgentInstallHelper.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,"GovAgentx64.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,"GovReachClient.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,"goverrmc.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,"govsrv*.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Goverlan,,,,,"Goverlan*",RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Guacamole,"Guacamole*",,,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Guacamole,,"guacamole.apache.org",,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Guacamole,,,,"guacd.exe",,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"GxM RMM Agent","GxM RMM Agent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+"GxM RMM Agent","GxMRMMAgent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+"GxM RMM Agent",,,"*\ProgramData\GxM\agent\GxM.Agent.exe",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+"GxM RMM Agent",,,"*\ProgramData\GxM\enrollment.json",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+"GxM RMM Agent",,,"*\ProgramData\GxM\install.log",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+"GxM RMM Agent",,,"C:\GxM\agent",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign."
+HeartbeatRM,"HeartbeatRM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,"*.heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,"heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,"*\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,"C:\Program Files (x86)\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,"C:\Program Files\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,,"agent-installer-any.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,,"hbrm-updater-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HeartbeatRM,,,,"hbrm-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation."
+HelpBeam,"HelpBeam*",,,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpBeam,,"helpbeam.software.informer.com",,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpBeam,,,,"helpbeam*.exe",,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,"HelpU*",,,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,"*.helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,"helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,,,"HelpuManager.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,,,"HelpuUpdater.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,,,"helpu_install.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,,,,"Help Manager Program",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpU,,,,,"helpU*",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+HelpWire,"HelpWire*",,,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"account.flexihub.com",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"api.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"get.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"staging.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"stun.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,"stunserver.stunprotocol.org",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,"/Applications/HelpWire Operator.app",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,"/lib/systemd/system/helpwire-unattended.service",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,"helpwire-operator/bin/helpwire-operator",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,,"HelpWire Quick.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,,"HelpWire Unattended Access.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,,"HelpWire.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HelpWire,,,,"helpwire.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates."
+HopToDesk,"HopToDesk*",,,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"api.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"download.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"signal.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"turn.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,"www.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,,"C:\Program Files (x86)\HopToDesk\HopToDesk.exe",,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,,,"HopToDesk-Standalone.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+HopToDesk,,,,"HopToDesk.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity."
+"I'm InTouch","I'm InTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch","I'mInTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch",,"*.01com.com",,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch",,,,"I'm InTouch Go Installer.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch",,,,"iit.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch",,,,"intouch.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"I'm InTouch",,,,,"I'm InTouch*",RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light","ISL Light*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light","ISLLight*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light",,"islonline.com",,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light",,,,"islalwaysonmonitor.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light",,,,"isllight.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Light",,,,"isllightservice.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online","ISL Online*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online","ISLOnline*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,"*.islonline.com",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,"*.islonline.net",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,"*\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,"*\ISLLight.exe",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,"C:\Program Files (x86)\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,"ISLLight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,"ISLLightClient.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,"islalwaysonmonitor.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,"isllight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,"isllightservice.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,,"ISL Light*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ISL Online",,,,,"ISL Online*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IT Agent","IT Agent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"IT Agent","ITAgent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"IT Agent",,,,"ITAgentRMMSender.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"IT Agent",,,,"ITAgentRMMSenderSL.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"IT Agent",,,,"ITAgentRMMSenderUpdater.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"IT Agent",,,,"ITAgentSender.aiui",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry."
+"ITSupport247 (ConnectWise)","ConnectWise*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ITSupport247 (ConnectWise)","ITSupport247*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ITSupport247 (ConnectWise)",,"*.itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ITSupport247 (ConnectWise)",,"itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ITSupport247 (ConnectWise)",,,,"saazapsc.exe",,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ImmyBot,"ImmyBot*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,"*.immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,"immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"*\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"C:\Program Files\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"C:\Program Files\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,"C:\Windows\Temp\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,,"ImmyAgent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,,"ImmyBot.Agent.Ephemeral.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,,"ImmyBot.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+ImmyBot,,,,"ImmyUpdater.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints."
+"Impero Connect","Impero Connect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Impero Connect","ImperoConnect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Impero Connect",,"imperosoftware.com",,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Impero Connect",,,,"ImperoClientSVC.exe",,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall","Instant Housecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall","InstantHousecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,"*.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,"*.instanthousecall.net",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,"instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,"secure.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,,,"InstantHousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,,,"hsloader.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,,,"ihcserver.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Instant Housecall",,,,"instanthousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Insync,"Insync*",,,,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Insync,,,"*Users\*\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Insync,,,"*\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Insync,,,"C:\Users\USERNAME\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control","IntelliAdmin Remote Control*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control","IntelliAdminRemoteControl*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,"*.intelliadmin.com",,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,,,"agent32.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,,,"agent64.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,,,"agent_setup_5.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,,,"iadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"IntelliAdmin Remote Control",,,,"intelliadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+InvGate,"InvGate*",,,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"*.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"docs.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"help.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"instances-info.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"instances-list.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"lb-insight-001.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"releases.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"trust-access.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"trust.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,"www.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\*",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\DepHlp.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\InvGate-ED.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\Software Matt.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateAssetsRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\sas.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console."
+"Iperius Remote","Iperius Remote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote","IperiusRemote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,"*.iperius-rs.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,"*.iperius.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,"*.iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,"iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,,,"iperius.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,,,"iperiusremote.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,,,,"Enter S.R.L*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,,,,"Iperius Remote*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Iperius Remote",,,,,"Enter Srl*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,"Itarian*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,"*.cmdm.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,"remoteaccess.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,"servicedesk.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"ComodoRemoteControl.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"ITSMAgent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"ITSMService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"ITarianRemoteAccessSetup.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"ItsmRsp.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"RAccess.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"RDesktop.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"RHost.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"RViewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,"RmmService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,,"RMM*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Itarian,,,,,"Itarian*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control","Ivanti Remote Control*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control","IvantiRemoteControl*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control",,"*.ivanticloud.com",,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control",,,,"AgentlessRC.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control",,,,"ArcUI.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Ivanti Remote Control",,,,"IvantiRemoteControl.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+JollysFastVNC,"JollysFastVNC*",,,,,RAT,"","JollysFastVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud","Jump Cloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud","JumpCloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud",,"*.api.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud",,"*.assist.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud",,,,"JumpCloud*.exe",,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Cloud",,,,,"JumpCloud*",RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop","Jump Desktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop","JumpDesktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,"*.jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,"*.jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,"jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,"jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,,,"jumpclient.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,,,"jumpconnect.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,,,"jumpdesktop.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,,,"jumpservice.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Jump Desktop",,,,"jumpupdater.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KHelpDesk,"KHelpDesk*",,,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KHelpDesk,,"*.khelpdesk.com.br",,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KHelpDesk,,,,"KHelpDesk.exe",,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KHelpDesk,,,,,"Ferramenta de Acesso Remoto",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KHelpDesk,,,,,"KHELPDESK*",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Kabuto,"Kabuto*",,,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Kabuto,,"*.kabuto.io",,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Kabuto,,,,"Kabuto.App.Runner.exe",,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KiTTY,"KiTTY*",,,,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KiTTY,,,"*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KiTTY,,,"C:\*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KickIdler,"KickIdler*",,,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KickIdler,,"kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KickIdler,,"my.kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KickIdler,,,,"grabberEM.*msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+KickIdler,,,,"grabberTT*.msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Komari,"Komari*",,,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,"ghcr.io",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,"github.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,"komari-document.pages.dev",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,"raw.githubusercontent.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,"www.komari.wiki",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"/etc/systemd/system/komari-agent.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"/etc/systemd/system/komari.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"/opt/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"/usr/local/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"C:\Program Files\Komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Komari,,,"C:\komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent."
+Koofr,"Koofr*",,,,,RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Koofr,,,,,"koofr*",RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,"LANDesk*",,,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,"*.ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,"*.ivanticloud.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,"*\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,"*\issuser.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,"*\softmon.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,"*\tmcsvc.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,"C:\Program Files (x86)\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,,"LANDeskPortalManager.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,,"issuser.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,,"landeskagentbootstrap.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,,"ldinv32.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LANDesk,,,,"ldsensors.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LS RMM","LS RMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM","LSRMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,"webserv.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,"www.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM Worker.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,,,"LS RMM Worker.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LS RMM",,,,"LS RMM.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use."
+"LabTeach (Connectwise Automate)","Connectwise Automate*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTeach (Connectwise Automate)","LabTeach*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTeach (Connectwise Automate)",,,,"ltsvc.exe",,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)","ConnectWise Automate*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)","LabTech RMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)","LabTech*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)","LabTechRMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)",,"connectwise.com",,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)",,,,"ltsvc.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)",,,,"ltsvcmon.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LabTech RMM (ConnectWise Automate)",,,,"lttray.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere","Laplink Everywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere","LaplinkEverywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,"atled.syspectr.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,"everywhere.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,"le.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"OOSysAgent.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"laplink-everywhere-setup*.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"laplink.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"laplinkeverywhere.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"llrcservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Everywhere",,,,"serverproxyservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Gold","Laplink Gold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Gold","LaplinkGold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Gold",,,,"laplink.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Laplink Gold",,,,"tsircusr.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Lavawall,"Lavawall*",,,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,"api-ca-1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,"caremote1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,"lavawinupdate.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,,"C:\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,,"C:\Program Files (x86)\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Lavawall,,,"C:\Program Files\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools."
+Level,"Level*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,"agents.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,"builds.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,"downloads.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,"level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,"online.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+Level,,,"C:\Program Files\Level\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity."
+"Level.io","Level.io*",,,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,"*.level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,"level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,,,"level-remote-control-ffmpeg.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,,,"level-windows-amd64.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,,,"level.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Level.io",,,,,"Level*",RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LightRmmAgent,"LightRmmAgent*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established."
+LightRmmAgent,,"light-rmm-monitor-20260825.azurewebsites.net",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established."
+LightRmmAgent,,,"C:\Program Files\LightRmmAgent\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established."
+"Lite Manager","Lite Manager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager","LiteManager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,"*\LMNoIpServer.exe",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,"*\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,"C:\Program Files\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,,,"LiteManager*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,,,"ROMServer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,,,"ROMViewer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Lite Manager",,,,,"Yakhnovets Denis*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,"LiteManager*",,,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,"*.litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,"*.litemanager.ru",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,"litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"ROMFUSClient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"ROMServer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"lmnoipserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"romfusclient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"romserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,"romviewer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,,"LiteManager*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,,"ROMServer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,,"ROMViewer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LiteManager,,,,,"Yakhnovets Denis*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LocalXpose,"LocalXpose*",,,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,"*.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,"api.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,"localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,"%APPDATA%\loclx\*",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,"*\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,"/usr/local/bin/loclx",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,"C:\Users\*\AppData\Local\Programs\loclx\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,,loclx,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LocalXpose,,,,"loclx.exe",,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure."
+LogMeIn,"LogMeIn*",,,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,"*.logmein.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,"*.logmein.eu",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,"*.logmeininc.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,"logmein-gateway.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,"logmeinrescue.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,,,,"RemotelyAnywhere*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+LogMeIn,,,,,"LogMeIn*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue","LogMeIn rescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue","LogMeInrescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,"*.logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,"*.logmeinrescue.eu",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,"logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,"rescue-data-cetner.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,"rescue-list.*.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue_srv.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,,,"lmi_rescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,,,"support-logmeinrescue*.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"LogMeIn rescue",,,,"support-logmeinrescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Lunixar,"Lunixar*",,,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"*.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"app.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"devrmm.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"downloads.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"mymeetinggoogle.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,"socket.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\Lunixar.Agent.Core.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\Lunixar.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\Lunixar.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\LunixarRemote.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\LunixarRemote.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\LunixarUpdater.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"*\Lunixar\LunixarUpdater.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,"C:\Program Files\Lunixar\*",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,,"Googlemeet.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,,"LunixarRMM*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+Lunixar,,,,"eDocument-*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts."
+MEGAsync,"MEGAsync*",,,,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,"*ProgramData\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,"*Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,"*\MEGAsyncSetup64.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,"*\MEGAupdater.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,"C:\Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,,,MEGAsync,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MEGAsync,,,,,"MEGA Limited",RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,"MSP360*",,,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,"*.cloudberrylab.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,"*.msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,"*.mspbackups.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,"msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"CBBackupPlan.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"Cloud.Backup.RM.Service.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"Cloud.Backup.Scheduler.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"CloudRaCmd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"CloudRaSd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"CloudRaService.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"CloudRaUtilities.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"Connect.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"Online Backup.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"RMM.Agent.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"Remote Desktop.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,"cbb.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,,"Cloud.Ra*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MSP360,,,,,"MSP360*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)","Desktop Central*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)","Manage Engine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)","ManageEngine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"*.-dms.zoho.com.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"*.dms.zoho.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"*.dms.zoho.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,,,"dcagentregister.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Manage Engine (Desktop Central)",,,,"dcagentservice.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ManageEngine RMM Central","ManageEngine RMM Central*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ManageEngine RMM Central","ManageEngineRMMCentral*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"ManageEngine ServiceDesk Plus","ManageEngine ServiceDesk Plus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus","ManageEngineServiceDeskPlus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,"*.manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,"manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,,"C:\Program Files (x86)\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,,"C:\Program Files\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.bin",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support."
+MeshCentral,"MeshCentral*",,,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,"meshcentral.com",,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,,"/usr/local/mesh_services/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,,"/usr/local/mesh_services/meshagent/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,,,"meshagent*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,,,"meshcentral*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+MeshCentral,,,,,meshcentral,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes."
+"Microsoft Quick Assist","Microsoft Quick Assist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Microsoft Quick Assist","MicrosoftQuickAssist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Microsoft Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Microsoft Quick Assist",,,,"quickassist.exe",,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Microsoft Quick Assist",,,,,"Quick Assist",RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,"Mikogo*",,,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,"*.mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,"*.mikogo4.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,"*.real-time-collaboration.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,"mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,"*Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,"*\Mikogo-Screen-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,"*\Mikogo-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,"C:\Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,,"mikogo-service.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,,"mikogo-starter.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,,"mikogo.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Mikogo,,,,"mikogolauncher.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Minexus,"Minexus*",,,,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review."
+Minexus,,,"/etc/systemd/system/minion.service",,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review."
+"Mini RMM Agent","Mini RMM Agent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"Mini RMM Agent","MiniRMMAgent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"Mini RMM Agent",,,"C:\Program Files\MiniRMM\MiniRmmAgent.exe",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\Invoke-AVExclusions.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\SmartScreenTest.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse."
+"MioNet (Also known as WD Anywhere Access)","Also known as WD Anywhere Access*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (Also known as WD Anywhere Access)","MioNet*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (Also known as WD Anywhere Access)",,,,"mionet.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (Also known as WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (WD Anywhere Access)","MioNet*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (WD Anywhere Access)","WD Anywhere Access*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (WD Anywhere Access)",,,,"mionet.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"MioNet (WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Miradore,"Miradore*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,"*.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,"gateway.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,"gerwconline.blob.core.windows.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,"miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,,"*\Miradore\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+Miradore,,,"C:\Program Files\Miradore\OnlineClient\bin\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access."
+"Mocha VNC Lite","Mocha VNC Lite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Mocha VNC Lite","MochaVNCLite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Mocha VNC Lite",,,"*\RealVNC\VNC4\*",,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Mocha VNC Lite",,,,"This installs a modified VNC and cannot be blocked by path separate from VNC",,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Monitic,"Monitic*",,,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"api.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"app.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"devapi.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"turn.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,"www.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,,"C:\Program Files\Monitic\*",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,,"C:\Program Files\Monitic\agent.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,,"C:\Program Files\Monitic\amon.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+Monitic,,,"C:\Program Files\Monitic\conf.json",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed."
+"Mouse Without Borders","Mouse Without Borders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"Mouse Without Borders","MouseWithoutBorders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+"Mouse Without Borders",,,"C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\*",,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+MultCloud,"MultCloud*",,,,,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MultCloud,,,,"requires sign up",,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyGreenPC,"MyGreenPC*",,,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyGreenPC,,"*.mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyGreenPC,,"mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyGreenPC,,,,"mygreenpc.exe",,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyIVO,"MyIVO*",,,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyIVO,,"myivo-server.software.informer.com",,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyIVO,,,,"myivomanager.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+MyIVO,,,,"myivomgr.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-ABLE Remote Access Software","N-ABLE Remote Access Software*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-ABLE Remote Access Software","N-ABLERemoteAccessSoftware*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-ABLE Remote Access Software","N-able*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-ABLE Remote Access Software",,"n-able.com",,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent","N-Able Advanced Monitoring Agent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent","N-AbleAdvancedMonitoringAgent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.swi-tc.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"*.systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,"systemmonitor.us.cdn.cloudflare.net",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"Agent_*_RW.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"BASEClient.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"BASupApp.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"BASupSrvc.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"BASupSrvcCnfg.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,"winagent.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,,"Remote Monitoring*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-Able Advanced Monitoring Agent",,,,,"N-Able*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"N-able N-central","N-able N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central","N-ableN-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central","N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"*.prd.cdo.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"comserver.eu1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"comserver.global.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"comserver.us1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"comserver.us2.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"eb.ap-southeast-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"eb.eu-central-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"eb.eu-west-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"eb.us-west-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"feeds.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"releases.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"sis.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"swi-rc.cdn-sw.net",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,"update.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,"/Library/MspAgent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,"/opt/msp-agent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,"C:\Program Files (x86)\Msp Agent\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,,"AgentMaint.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,,"AgentMonitor.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"N-able N-central",,,,"msp-agent-core.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08."
+"NTR Remote","NTR Remote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NTR Remote","NTRRemote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NTR Remote",,"*.ntrsupport.com",,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NTR Remote",,,,"NTRsupportPro_EN.exe",,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NTR Remote",,,,,"Net Transmit & Receive SL",RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NVDA (Non-Visual Desktop Access)","NVDA*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)","Non-Visual Desktop Access*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,"*.nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,"nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files (x86)\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Local\Temp\nvda_*\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Roaming\nvda\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,,"nvda.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,,"nvda_*.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+"NVDA (Non-Visual Desktop Access)",,,,"nvda_service.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities."
+Naverisk,"Naverisk*",,,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Naverisk,,"naverisk.com",,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Naverisk,,,,"AgentSetup-*.exe",,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Naverisk,,,,,"NavMK1 Limited*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Naverisk,,,,,"naverisk*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Net Monitor for Employees","Net Monitor for Employees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees","NetMonitorforEmployees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,"C:\Program Files (x86)\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,"C:\Program Files\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,,"nmep_agtconfig.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,,"nmep_ctrlagent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,,"nmep_ctrlagentsvc.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,,"winpty-agent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+"Net Monitor for Employees",,,,"winpty-agent64.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware."
+NetBird,"NetBird*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"*.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"192.3.95.152",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"198.46.178.135",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"api.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"app.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"cloud-233f9.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"cloud-ed980.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"googl-165a0.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"googl-6c11f.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"googl-6c11f.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"login.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"my-sharepoint-inc.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"my1cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"my2cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"pkgs.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"relay.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"signal.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,"web-16fe.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"/Applications/NetBird UI.app",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"/etc/netbird/install.conf",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"/opt/netbird/*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"/usr/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"/usr/local/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\Program Files\Netbird\netbird-ui.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\Program Files\Netbird\netbird.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\ProgramData\Netbird\*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\bin\OpenSSH.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\bin\cis.vbs",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\bin\netbird.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\bin\trm.zip",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,"C:\temper\trm",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,,netbird,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,,"netbird-ui.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+NetBird,,,,"netbird.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)."
+"NetLock RMM","NetLock RMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM","NetLockRMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"/Library/Application Support/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"/usr/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"/usr/local/bin/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"/var/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_Process.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_UAC.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,"C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,,"NetLock_RMM_Agent_Installer",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+"NetLock RMM",,,,"NetLock_RMM_Agent_Installer.exe",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering."
+NetMaster,"NetMaster*",,,,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review."
+NetMaster,,,"C:\ProgramData\NetMaster\NetMaster_Client.exe",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review."
+NetMaster,,,"C:\ProgramData\NetMaster\config.ini",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review."
+"NetSupport Manager","NetSupport Manager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager","NetSupport*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager","NetSupportManager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,"*.netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,"geo.netsupportsoftware.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,"netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,,,"client32.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,,,"pcicfgui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,,,"pcictlui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,,,"remcmdstub.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+"NetSupport Manager",,,,,netsupport,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub."
+Netop,"Netop*",,,,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netop,,,"*\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netop,,,"*\Netop Remote Control\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netop,,,"C:\Program Files\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)","Impero Connect*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)","Netop Remote Control*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)","NetopRemoteControl*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,"*.connect.backdrop.cloud",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,"*.netop.com",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"Connect.Backdrop.cloud*.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"ImperoClientSVC.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"ImperoInit.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"Netop Ondemand.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"ngstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"nhostsvc.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"nhstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"nldrw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,,"Impero Connect*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (Impero Connect)",,,,,"Impero Solutions*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)","Netop Remote Control*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)","NetopRemoteControl*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)","aka Impero Connect*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,"nhostsvc.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,"nhstw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,"nldrw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,,"Impero Connect*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netop Remote Control (aka Impero Connect)",,,,,"Impero Solutions*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netreo,"Netreo*",,,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netreo,,"*.api.netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netreo,,"activation.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netreo,,"charon.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netreo,,"netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Neturo,"Neturo*",,,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Neturo,,"neturo.uplus.co.kr",,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Neturo,,,,"neturo*.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Neturo,,,,"neturo.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Neturo,,,,"ntrntservice.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netviewer,"Netviewer*",,,,,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netviewer,,,,"netviewer*.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Netviewer,,,,"netviewer.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)","GoToMeet*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)","Netviewer*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,"*.netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,"netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,,,"NetViewer.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,,,"nvClient.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,,,"nvConsole.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Netviewer (GoToMeet)",,,,,"Algorius*",RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Nexus RMM (Scogo)","Nexus RMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"Nexus RMM (Scogo)","NexusRMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"Nexus RMM (Scogo)","Scogo*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"Nexus RMM (Scogo)",,,,"nexusrmm.exe",,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution."
+Nezha,"Nezha*",,,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"c.mid.al",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"gd.bj2.xyz",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"github.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"nezha.wiki",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"nezhahq.github.io",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"raw.githubusercontent.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,"rism.pages.dev",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"*\nezha-agent.exe",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/etc/systemd/system/nezha-agent.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/etc/systemd/system/nezha-dashboard.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/opt/nezha/*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/opt/nezha/agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/opt/nezha/agent/nezha-agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"/opt/nezha/dashboard",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"C:\Program Files\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,"C:\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,,"dashboard-windows-amd64.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,,"nezha-agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,,"nezha-agent.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+Nezha,,,,"nezha_agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade."
+"NinjaOne (formerly NinjaRMM)","NinjaOne*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NinjaOne (formerly NinjaRMM)","formerly NinjaRMM*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NinjaOne (formerly NinjaRMM)",,,"*ProgramData\NinjaRMMAgent\*",,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,"NinjaRMM*",,,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"*.rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"resources.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,"rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,,,"NinjaRMMAgent.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,,,"NinjaRMMAgentPatcher.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,,,"ninjarmm-cli.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,,,,"Ninja MSP*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NinjaRMM,,,,,"NinjaRMM*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,"NoMachine*",,,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,,"nomachine.com",,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,,,,"nomachine*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,,,,"nxd.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,,,,"nxservice*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NoMachine,,,,,"NoMachine*",RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NordLocker,"NordLocker*",,,,,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NordLocker,,,,,NordLocker,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NordLocker,,,,,"NordSec Update Service",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+NordLocker,,,,,"nordvpn*",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NoteOn-desktop sharing","NoteOn-desktop sharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NoteOn-desktop sharing","NoteOn-desktopsharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NoteOn-desktop sharing",,,,"nateon*.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NoteOn-desktop sharing",,,,"nateon.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"NoteOn-desktop sharing",,,,"nateonmain.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory","OCS inventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory","OCSinventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory",,"ocsinventory-ng.org",,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory",,,,"ocsinventory.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory",,,,"ocsservice.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory",,,,,"OcsPackager*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"OCS inventory",,,,,"Ocs Inventory*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Obliance,"Obliance*",,,,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/Library/LaunchDaemons/com.obliance.agent.plist",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/etc/obliance-agent/config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/etc/systemd/system/obliance-agent.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/etc/systemd/system/obliance-watchdog.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/opt/obliance-agent/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/usr/local/bin/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"/var/log/obliance-agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\Program Files\OblianceAgent\obliance-agent.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\Program Files\OblianceAgent\obliance-tray.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\Program Files\OblianceAgent\obliance-watchdog.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\ProgramData\OblianceAgent\agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\ProgramData\OblianceAgent\config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Obliance,,,"C:\ProgramData\OblianceAgent\watchdog.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use."
+Onionshare,"Onionshare*",,,,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Onionshare,,,"*\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Onionshare,,,"*\onionshare*.exe",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Onionshare,,,"C:\Program Files (x86)\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Onionshare,,,,"OnionShare-win*.msi",,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Opale,"Opale*",,,,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform."
+Opale,,,"C:\ProgramData\Opale\opale-agent.exe",,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform."
+"OpenDesk RMM Agent","OpenDesk RMM Agent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary."
+"OpenDesk RMM Agent","OpenDeskRMMAgent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary."
+"OpenDesk RMM Agent",,,,"OpenDesk-RMM-Agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary."
+"OpenDesk RMM Agent",,,,"opendesk-rmm-agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary."
+OpenUEM,"OpenUEM*",,,,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"/Library/OpenUEMAgent/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"/var/log/openuem-agent/openuem-agent.log",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"C:\Program Files\OpenUEM Agent\*",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"C:\Program Files\OpenUEM Agent\config\openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+OpenUEM,,,"C:\Program Files\OpenUEM Agent\logs\openuem-log.txt",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use."
+"OpsBridge Agent","OpsBridge Agent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+"OpsBridge Agent","OpsBridgeAgent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+"OpsBridge Agent",,"opsbridge.digital",,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+"OpsBridge Agent",,,"C:\Program Files\OpsBridge\OpsBridgeAgent.exe",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+"OpsBridge Agent",,,"C:\ProgramData\OpsBridge\*",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+"OpsBridge Agent",,,"C:\Windows\System32\Tasks\OpsBridge Agent",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name."
+OptiTune,"OptiTune*",,,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,"*.opti-tune.com",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,"*.optitune.us",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,,,"OTPowerShell.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,,,"OTService.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,,,,"OptiTune*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+OptiTune,,,,,"Bravura Software*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Overlord,"Overlord*",,,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"*.ngrok-free.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"*.ngrok.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"*.ngrok.com",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"*.ngrok.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"pandoramods.top",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,"savaliyapriyal874-code.github.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\AppData\Roaming\Overlord\agent.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\agent-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,"*\svchost-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+Overlord,,,,"ovd_*.exe",,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS."
+PChelpware,"PChelpware*",,,,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations."
+PChelpware,,,"*\PcHelpWare_viewer.exe",,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations."
+"PDQ Connect","PDQ Connect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect","PDQConnect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,"app.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,"cfcdn.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,"pdqinstallers.*.r2.cloudflarestorage.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,,,"PDQConnectUpdater-*.msi",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,,,"pdq-connect*.exe",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,,,,"PDQConnectAgent*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"PDQ Connect",,,,,"PDQ.com*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)","Pandora RC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)","PandoraRC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)","eHorus*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)",,"portal.ehorus.com",,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)",,,,"ehorus standalone.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)",,,,"ehorus_agent.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pandora RC (eHorus)",,,,,"eHorus*",RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,"Panorama9*",,,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,,"changes.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,,"panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,,"trusted.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,,,,"p9agent*.exe",,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Panorama9,,,,,"Panorama9*",RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Parsec,"Parsec*",,,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,"*.parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,"parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,"parsec.gg",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,,"C:\Program Files\Parsec\*",,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,,,"parsecd.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Parsec,,,,"pservice.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access."
+Pcnow,"Pcnow*",,,,,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcnow,,,,"mwcliun.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcnow,,,,"pcnmgr.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcnow,,,,"webexpcnow.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,"Pcvisit*",,,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,"*.pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,"pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,,,"pcvisit-easysupport.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,,,"pcvisit.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,,,"pcvisit_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,,,"pcvisit_service_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pcvisit,,,,,"pcvisit*",RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,"Pilixo*",,,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,"*.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,"download.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,"pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,,,"Pilixo_Installer*.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,,,"rdp.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pilixo,,,,,"Pilixo*",RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)","Pocket Cloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)","PocketCloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)","Wyse*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)",,,,"pocketcloud*.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)",,,,"pocketcloudservice.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Cloud (Wyse)",,,,,"PocketCloud*",RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller","Pocket Controller*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller","PocketController*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller",,,,"pocketcloudservice.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller",,,,"pocketcontroller.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller",,,,"wysebrowser.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)","Pocket Controller*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)","PocketController*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)","Soti Xsight*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,"*.soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,"soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,,,"XSightService.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,,,"pocketcontroller.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,,,"wysebrowser.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Pocket Controller (Soti Xsight)",,,,,"Pocket Controller*",RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ProxiPort,"ProxiPort*",,,,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+ProxiPort,,,"/etc/proxiport/proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+ProxiPort,,,"/lib/systemd/system/proxiport.service",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+ProxiPort,,,"/usr/bin/proxiport",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.exe",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort."
+Pulseway,"Pulseway*",,,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pulseway,,"pulseway.com",,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pulseway,,,,"PCMonitorManager.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pulseway,,,,"pcmonitorsrv.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pulseway,,,,,"MMSoft Design*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Pulseway,,,,,"Pulseway*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance","QQ IM-remote assistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance","QQIM-remoteassistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,"*.desktop.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,"*.mdt.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,"qq-messenger.en.softonic.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,"upload_data.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,,,"QQProtect.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,,,"qq.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,,,"qqpcmgr.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,,,,"QQ*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"QQ IM-remote assistance",,,,,"Tencent*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)","Quest KACE Agent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)","QuestKACEAgent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)","formerly Dell KACE*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)",,"*.kace.com",,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)",,,,"konea.exe",,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quest KACE Agent (formerly Dell KACE)",,,,,"KACE Agent*",RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quick Assist","Quick Assist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quick Assist","QuickAssist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Quick Assist",,,,"quickassist.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,"RAdmin*",,,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,"radmin.com",,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,"C:\Program Files (x86)\Radmin Viewer 3\Radmin.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrf2",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrfc",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,"C:\Windows\SysWOW64\rserver30\rserver3.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,,,"radmin*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RAdmin,,,,,"famatech*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RDCMan,"RDCMan*",,,,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+RDCMan,,,"*\RDCMan-x86.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+RDCMan,,,"*\RDCMan.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only."
+RDPView,"RDPView*",,,,,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RDPView,,,,"dwrcs.exe",,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager","RES Automation Manager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager","RESAutomationManager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager",,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager",,,,"wisshell*.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager",,,,"wmc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager",,,,"wmc_deployer.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RES Automation Manager",,,,"wmcsvc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"RG System (RG Supervision)","RG Supervision*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)","RG System*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)","RGSystem*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)",,"api.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)",,"dashboard.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)",,"lisa.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)",,,"C:\Program Files (x86)\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+"RG System (RG Supervision)",,,"C:\Program Files\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage."
+RMMCRAT,"RMMCRAT*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent."
+RMMCRAT,,"softbymade.top",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent."
+RMMCRAT,,,"C:\ProgramData\RMMAgent\*",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent."
+RMMmax,"RMMmax*",,,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,"api.rmmmax.com",,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,,"%ProgramData%\rmmmax\AgentService\RMMmaxAgentService.exe",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,,"/Applications/RMMmax Agent.app/Contents/MacOS/RMMmax Agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,,"/usr/local/bin/rmmmax-agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,,"/var/rmmmax/agentservice/rmmmax_agent.py",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RMMmax,,,,"RMMmaxAgentSetup.exe",,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux."
+RPort,"RPort*",,,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RPort,,"rport.io",,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RPort,,,,"rport.exe",,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RdClient,"RdClient*",,,,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RdClient,,,"C:\Program Files (x86)\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RdClient,,,"C:\Program Files\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RdClient,,,,"RdClientInstaller.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RdClient,,,,"SupportTool.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RdClient,,,,"rdclient.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer."
+RealVNC,"RealVNC*",,,,,RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RealVNC,,,,,"realvnc*",RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemSupp,"RemSupp*",,,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+RemSupp,,"api.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+RemSupp,,"download.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\Uninstall RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+RemSupp,,,"C:\Users\*\AppData\Local\remsupp-updater\installer.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com."
+Remcos,"Remcos*",,,,,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remcos,,,,"remcos*.exe",,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remmina,"Remmina*",,,,,RAT,"","Remmina is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remmon,"Remmon*",,,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remmon,,"*.remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remmon,,"remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remmon,,,,"remmon.exe",,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remobo,"Remobo*",,,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remobo,,"remobo.en.softonic.com",,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remobo,,,,"remobo.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remobo,,,,"remobo_client.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remobo,,,,"remobo_tracker.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Manager (Devolutions)","Devolutions*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Manager (Devolutions)","Remote Desktop Manager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Manager (Devolutions)","RemoteDesktopManager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Plus","Remote Desktop Plus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Plus","RemoteDesktopPlus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Plus",,"donkz.nl",,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Plus",,,,"rdp.exe",,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Desktop Plus",,,,,"Remote Desktop Plus*",RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System","Remote Manipulator System*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System","RemoteManipulatorSystem*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System",,"*.internetid.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System",,"rmansys.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System",,,,"rfusclient.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Manipulator System",,,,"rutserv.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Ripple","Remote Ripple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control."
+"Remote Ripple","RemoteRipple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control."
+"Remote Ripple",,,"C:\Program Files (x86)\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control."
+"Remote Ripple",,,"C:\Program Files\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control."
+"Remote Ripple",,,,"RemoteRipple.exe",,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control."
+"Remote Utilities","Remote Utilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Utilities","RemoteUtilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Utilities",,"*.internetid.ru",,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Utilities",,,,"rutserv.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Utilities",,,,"rutview.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote Utilities",,,,,"Remote Utilities*",RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it","Remote.it*",,,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,"api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,"auth.api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,"remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,,,"remote-it-installer.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,,,"remote.it.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Remote.it",,,,"remoteit.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteAgentAgent,"RemoteAgentAgent*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent."
+RemoteAgentAgent,,"app-af-agent-prod-009.azurewebsites.net",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent."
+RemoteAgentAgent,,,"C:\Program Files\RemoteAgent\RemoteAgentAgent.exe",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent."
+RemoteCall,"RemoteCall*",,,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,"*.remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,"*.startsupport.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,"remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"agentu.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"raautoup.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"rcengmgru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"rcmgrsvc.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"rcstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"remotesupportplayeru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,"rxstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteCall,,,,,"RSUPPORT*",RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,"RemotePC*",,,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,"*.remotedesktop.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,"*.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,"remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,"www.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,"*\RemotePCService.exe",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,"*\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"Idrive.File-Transfer",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"RemotePC.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"RemotePCService.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"idrive.RemotePCAgent",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"remotepchost.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"remotepcservice.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,"rpcsuite.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,,"remotepc*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePC,,,,,"remotedesktop*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePass,"RemotePass*",,,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePass,,"remotepass.com",,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePass,,,,"remotepass-access.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePass,,,,"rpaccess.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePass,,,,"rpwhostscr.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemotePulse,"RemotePulse*",,,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,"remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,"www.remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\agent.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.cmd",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io."
+RemoteUtilities,"RemoteUtilities*",,,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,"remoteutilities.com",,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,"*\Remote Manipulator System - Server\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,"*\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,"*\rutserv.exe",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,"C:\Program Files\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,,"rutserv.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,,"rutview.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteUtilities,,,,,"Remote Utilities*",RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,"RemoteView*",,,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,"*.content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,"*.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,"content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,"remoteview.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,"rv.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,"rvagent.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,"rvagtray.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,,"RsDoctor*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RemoteView,,,,,"RemoteView*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Remotely,"Remotely*",,,,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"/Library/LaunchDaemons/remotely-agent.plist",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"/etc/systemd/system/remotely-agent.service",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"/usr/local/bin/Remotely/ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"/usr/local/bin/Remotely/Desktop/Remotely_Desktop",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"/usr/local/bin/Remotely/Remotely_Agent",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"C:\Program Files\Remotely\ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"C:\Program Files\Remotely\Desktop\Remotely_Desktop.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"C:\Program Files\Remotely\Remotely_Agent.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+Remotely,,,"C:\Program Files\Remotely\etag.txt",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions."
+"Rocket Remote Desktop","Rocket Remote Desktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Rocket Remote Desktop","RocketRemoteDesktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Rocket Remote Desktop",,,,"RDConsole.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Rocket Remote Desktop",,,,"RocketRemoteDesktop_Setup.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Rodex RMM","Rodex RMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM","RodexRMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,"",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,"rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,"www.rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,,"C:\Program Files\Rodex\RodexAgent.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,,"C:\Windows\.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,,,"RodexAgent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+"Rodex RMM",,,,"rodexagent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents."
+Roster,"Roster*",,,,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"/Library/LaunchDaemons/com.roster.agent.plist",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"/etc/roster/agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"/etc/systemd/system/roster-agent.service",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"/usr/local/bin/roster-agent",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"/var/log/roster-agent.log",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"C:\Program Files\Roster\*",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"C:\ProgramData\Roster\agent-state.json",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+Roster,,,"C:\ProgramData\Roster\agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use."
+"Royal Apps","Royal Apps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Apps","RoyalApps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Apps",,,,"royalserver.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Apps",,,,"royalts.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Server","Royal Server*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Server","RoyalServer*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal Server",,"royalapps.com",,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal TS","Royal TS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal TS","RoyalTS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal TS",,"royalapps.com",,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Royal TS",,,,"royalts.exe",,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RuDesktop,"RuDesktop*",,,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RuDesktop,,"*.rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RuDesktop,,"rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RuDesktop,,,,"rd.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RuDesktop,,,,"rudesktop*.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RunSmart,"RunSmart*",,,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RunSmart,,"runsmart.io",,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+RustDesk,"RustDesk*",,,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,"api.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,"rs-ny.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,"rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,"web.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,"C:\Program Files\RustDesk",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,"C:\Program Files\RustDesk\RustDesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\*",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\rustdesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,,"rustdesk*.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,,"rustdesk.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+RustDesk,,,,,"rustdesk*",RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment."
+ScreenConnect,"ScreenConnect*",,,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,"*.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,"*.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,"control.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,"instance-*-relay.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,"*\*\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,"*\*\ScreenConnect.WindowsClient.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,"*\ScreenConnect Client*\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client (Random)\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"ConnectWiseControl*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"Remote Workforce Client.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"connectwise*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"screenconnect*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"screenconnect.clientservice.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,"screenconnect.windowsclient.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,,"CONTINUUM MANAGED*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,,"ScreenConnect*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenConnect,,,,,"ConnectWise*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,"ScreenMeet*",,,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,,"*.screenmeet.com",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,,"*.scrn.mt",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,,,,"ScreenMeet.Support.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,,,,"ScreenMeetSupport.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ScreenMeet,,,,,"ScreenMeet*",RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SecureCRT,"SecureCRT*",,,,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SecureCRT,,,"*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SecureCRT,,,"*\VanDyke Software\ClientPack\*",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SecureCRT,,,"C:\*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,"Seetrol*",,,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,"seetrol.co.kr",,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,,,"seetrolcenter.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,,,"seetrolclient.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,,,"seetrolmyservice.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,,,"seetrolremote.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Seetrol,,,,"seetrolsetting.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud","Senso.cloud*",,,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud",,"*.senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud",,"senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud",,,,"SensoClient.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud",,,,"SensoService.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Senso.cloud",,,,"aadg.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sentinel RMM","Sentinel RMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit."
+"Sentinel RMM","SentinelRMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit."
+"Sentinel RMM",,,"/opt/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit."
+"Sentinel RMM",,,"/usr/local/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit."
+"Sentinel RMM",,,"C:\ProgramData\SentinelAgent\sentinel-agent.exe",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit."
+ServerEye,"ServerEye*",,,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ServerEye,,"*.server-eye.de",,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ServerEye,,,,"ServiceProxyLocalSys.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ServerEye,,,,"servereye*.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ServerEye,,,,,"Server-Eye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ServerEye,,,,,"ServerEye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"SetMe PRO","SetMe PRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+"SetMe PRO","SetMePRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+"SetMe PRO",,"*.set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+"SetMe PRO",,"set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Client\SetMe_Client.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Module\*\tinUnattendedModule.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains."
+ShellHub,"ShellHub*",,,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,"*.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,"cloud.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,"shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,"www.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,,"/etc/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,,"/etc/systemd/system/shellhub-agent.service",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,,"/usr/local/bin/shellhub-agent",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShellHub,,,"/var/lib/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist."
+ShowMyPC,"ShowMyPC*",,,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,"*.showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,"showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,,,"SMPCSetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,,,"showmypc*.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,,,"showmypc.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,,,"smpcsetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ShowMyPC,,,,,"ShowMyPC*",RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SimpleHelp,"SimpleHelp*",,,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"160.191.182.41",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"192.144.34.42",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"51.255.19.178",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"51.255.19.179",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"dronemaker.org",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"microuptime.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"simple-help.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,"telesupportgroup.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,"%APPDATA%\JWrapper-SimpleSetup\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,"C:\ProgramData\JWrapper-Remote Access\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"remote access.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"serviceconfig.xml",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"simplegatewayservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"simplehelpcustomer.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"simpleservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"spsrv.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"vhost.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,"windowslauncher.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+SimpleHelp,,,,,"SimpleHelp*",RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026."
+Site24x7,"Site24x7*",,,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,"plus*.site24x7.cn",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,"plus*.site24x7.com",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,"plus*.site24x7.eu",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,"plus*.site24x7.in",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,"plus*.site24x7.net.au",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,,,"MEAgentHelper.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,,,"MonitoringAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,,,"Site24x7PluginAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Site24x7,,,,"Site24x7WindowsAgentTrayIcon.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,"SkyFex*",,,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,"*.deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,"deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,"skyfex.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,,,"DeskRollUA.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,,,"Deskroll.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SkyFex,,,,,"DeskRoll Remote Desktop*",RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Solar-PuTTY","Solar-PuTTY*",,,,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Solar-PuTTY",,,"*\Solar-PuTTY.exe",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Solar-PuTTY",,,"*\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Solar-PuTTY",,,"C:\Program Files\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System","Sophos-Remote Management System*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System","Sophos-RemoteManagementSystem*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,"*.sophos.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,"*.sophosupd.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,"*.sophosupd.net",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,,,"clientmrinit.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,,,"mgntsvc.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Sophos-Remote Management System",,,,"routernt.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Sorillus,"Sorillus*",,,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Sorillus,,"*.sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Sorillus,,"sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Sorillus,,,,"Sorillus Launcher.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Sorillus,,,,"Sorillus-Launcher*.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SparkRAT,"SparkRAT*",,,,,RAT,"https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/README.md,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/scripts/build.client.sh,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/client/core/core.go,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/server/handler/handler.go,https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/,https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections","SparkRAT (Spark) is an open-source Go remote-access framework with a self-hosted controller that generates configured endpoint clients. It offers remote terminal, desktop, screenshot, file, and process functions. Public reporting has documented malicious SparkRAT deployments; that does not make every deployment of the upstream dual-use project malicious."
+Splashtop,"Splashtop*",,,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Splashtop,,"*.splashtop.com",,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Splashtop,,,"*\Splashtop\Splashtop Remote\Client for RMM\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Splashtop,,,"C:\Program Files (x86)\Splashtop\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Splashtop,,,,"strwinclt.exe",,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)","Beta*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)","Splashtop*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)",,"splashtop.com",,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)",,,,"SRManager.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)",,,,"SRServer.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)",,,,"SplashtopSOS.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop (Beta)",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote","Splashtop Remote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote","SplashtopRemote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,"*.api.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,"*.api.splashtop.eu",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,"*.relay.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,"splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"SplashtopSOS.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"sragent.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"srmanager.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"srserver.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"srservice.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,"strwinclt.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Splashtop Remote",,,,,"Splashtop*",RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SpyAnywhere,"SpyAnywhere*",,,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SpyAnywhere,,"*.spytech-web.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SpyAnywhere,,"spyanywhere.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SpyAnywhere,,,,"sysdiag.exe",,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,"SunLogin*",,,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,"client.oray.net",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,"sunlogin.oray.com",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,,,"OrayRemoteService.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,,,"OrayRemoteShell.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,,,"sunlogin*.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,,,,"Remote control service",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SunLogin,,,,,"Shanghai Best Oray*",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,"SuperOps*",,,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,"*.superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,"*.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,"*.superopsbeta.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,"serv.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,"superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,,,"superops.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,,,"superopsticket.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperOps,,,,,"SuperOps*",RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperPuTTY,"SuperPuTTY*",,,,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperPuTTY,,,"*Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperPuTTY,,,"*\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperPuTTY,,,"*\superputty.exe",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SuperPuTTY,,,"C:\Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,"Supremo*",,,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,"*.supremocontrol.com",,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,"%USERPROFILE%\\AppData\\Local\\Temp\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,"*\\supremoremotedesktop\\supremosystem.exe",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,"C:\\ProgramData\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,"SupremoSystem.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,"supremo.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,"supremohelper.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,"supremoservice.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,,"NanoSystems*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Supremo,,,,,"SupRemo*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,"Syncro*",,,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"*.kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"*.syncroapi.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"*.syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"app.kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"attachments.servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"ld.aurelius.host",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"repairshopr.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,"syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Kabuto.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Kabuto.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Kabuto.Service.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"KabutoSetup.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Syncro.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Syncro.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Syncro.Overmind.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"Syncro.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"SyncroLive.Agent.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,"SyncroLive.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,,"Syncro*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syncro,,,,,"Servably*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Synergy,"Synergy*",,,,,RAT,"https://symless.com/synergy","Synergy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SysAid,"SysAid*",,,,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SysAid,,,"*\IliAS.exe",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SysAid,,,"*\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SysAid,,,"*\SysAid\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+SysAid,,,"C:\Program Files\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,"Syspectr*",,,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,"*.syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,"syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,,,"oolocker.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,,,"oosyspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,,,"syspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Syspectr,,,,,"O&O Syspectr*",RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM","Tactical RMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM","TacticalRMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM",,"docs.tacticalrmm.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM",,"login.tailscale.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM",,,,"tacticalrmm.exe",,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM",,,,,"Tactical Techs*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Tactical RMM",,,,,"AmidaWare*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TeamViewer,"TeamViewer*",,,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,"*.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,"client.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,"router15.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,"taf.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,"C:\Program Files\TeamViewer\",,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,"teamviewer_desktop.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,"teamviewer_service.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,teamviewerhost,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,teamviewer*.exe,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,tv_w32.exe,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,tv_x64.exe,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeamViewer,,,,,"TeamViewer*",RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool."
+TeleDesktop,"TeleDesktop*",,,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TeleDesktop,,"tele-desk.com",,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TeleDesktop,,,,"pstlaunch.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TeleDesktop,,,,"ptdskclient.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TeleDesktop,,,,"ptdskhost.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Teleport Connect","Teleport Connect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect","TeleportConnect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,"*.teleport.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,"cdn.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,"reporting-connect.teleportinfra.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,"usage.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,"/Applications/Teleport Connect.app/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,"/opt/Teleport Connect/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,"/usr/local/bin/tsh",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,"C:\Program Files\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,"C:\Users\*\AppData\Local\Programs\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+"Teleport Connect",,,,"Teleport Connect Setup-*.exe",,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface."
+Teramind,"Teramind*",,,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"*.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"rt.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"sentry.dev.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,"www.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"/Applications/Teramind Agent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"/Applications/tmagent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"/usr/local/teramind/agent/bin/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"/usr/local/teramind/agent/bin/tmsysd",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"/usr/local/teramind/agent/etc/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\Package Cache\.unverified\agent",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\Teramind Agent\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\tmagentsvc.exe",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\Teramind Agent\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\updates\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own."
+TiFLUX,"TiFLUX*",,,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"*.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"agent.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"app.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"my.splashtop.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"www.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,"www.tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"%ProgramData%\Tiflux\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"/Applications/TiAgent.app",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiUpdateService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\7zip\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\tar\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+TiFLUX,,,"C:\Program Files (x86)\TiFLUX\si.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server."
+ToDesk,"ToDesk*",,,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,"*.todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,"todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,,,"ToDesk_Service.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,,,"ToDesk_Setup.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,,,"todesk.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ToDesk,,,,,"ToDesk*",RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment","Total Software Deployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment","TotalSoftwareDeployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,"*\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,"*\Tsdservice.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,"*\tniwinagent.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,"C:\ProgramData\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,,,"Total Software Deployment",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Total Software Deployment",,,,,"SoftInventive Lab",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+TrustConnect,"TrustConnect*",,,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,"networkservice.cyou",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,"trustconnectsoftware.com",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,"*\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,"C:\Program Files\TrustConnect Agent\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,"C:\Program Files\TrustConnect Agent\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,"C:\ProgramData\TrustConnect\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,,"DocConnect.Agent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+TrustConnect,,,,"TrustConnectAgent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou."
+UltraViewer,"UltraViewer*",,,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,"*.ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,"ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,"*\UltraViewer\",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,"*\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"UltraViewer_Desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"UltraViewer_Service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"UltraViewer_setup*",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"ultraviewer.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"ultraviewer_desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,"ultraviewer_service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,,"DucFabulous*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+UltraViewer,,,,,"UltraViewer*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"UniSystem RMM","UniSystem RMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"UniSystem RMM","UniSystemRMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"UniSystem RMM",,,,"UniRMM.exe",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution."
+"UniSystem RMM",,,,"UniRMM.msi",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution."
+VIZOR,"VIZOR*",,,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"downloads.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"mail.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"www.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"www.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,"www.vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,,"C:\Program Files (x86)\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,,"C:\Program Files\Vector Networks Limited\LANutil32 Suite\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+VIZOR,,,"C:\Program Files\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)."
+"VNC Connect","VNC Connect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"VNC Connect","VNCConnect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"VNC Connect",,,"*\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"VNC Connect",,,"C:\Program Files\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Veyon,"Veyon*",,,,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,"C:\Program Files (x86)\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,"C:\Program Files\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,,"veyon-master.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,,"veyon-server.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,,"veyon-service.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,,"veyon-wcli.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+Veyon,,,,"veyon-worker.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support."
+"Vicarius vRx","Vicarius vRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx","VicariusvRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"*.vicarius.cloud",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-release.s3.us-east-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,"vicarius-static-organizationinstallations.vicarius-cdn.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,,"/Library/PrivilegedHelperTools/topiad",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,,"/usr/share/vicarius/*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,,"C:\Program Files\Vicarius\Topia\*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Vicarius vRx",,,,"topiad.exe",,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder."
+"Visual Studio Dev Tunnel","Visual Studio Dev Tunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Visual Studio Dev Tunnel","VisualStudioDevTunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Visual Studio Dev Tunnel",,"*.devtunnels.ms",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Visual Studio Dev Tunnel",,"*.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Visual Studio Dev Tunnel",,"global.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,"Weezo*",,,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,"*.weezo.me",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,"*.weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,"weezo.en.softonic.com",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,"weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,,,"weezo setup*.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,,,"weezo.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,,,"weezohttpd.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,,,,"Weezo*",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Weezo,,,,,"Peer 2 World",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,"Xeox*",,,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,"*.xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,"xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,,,"xeox-agent_*.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,,,"xeox-agent_x64.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,,,"xeox-agent_x86.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xeox,,,,"xeox_service_windows.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xpra,"Xpra*",,,,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xpra,,,"*\Xpra-Launcher.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xpra,,,"*\Xpra-x86_64_Setup.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xpra,,,"*\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Xpra,,,"C:\Program Files (x86)\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zabbix Agent","Zabbix Agent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zabbix Agent","ZabbixAgent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zabbix Agent",,"zabbix.com",,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zabbix Agent",,,,"zabbix_agent*.exe",,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zabbix Agent",,,,,"Zabbix*",RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+Zecurit,"Zecurit*",,,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,"app.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,"d1m8kha1zyjal6.cloudfront.net",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,"dms.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/Library/zecurit_agent/bin/CommandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/Library/zecurit_agent/bin/Installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/Library/zecurit_agent/bin/Service",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/Library/zecurit_agent/bin/ZecuritAccess.app/Contents/MacOS/ZecuritAccess",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/usr/local/zecurit_agent/bin/agentService",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/usr/local/zecurit_agent/bin/commandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"/usr/local/zecurit_agent/bin/installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+Zecurit,,,"C:\Windows\Temp\Zecurit\ZecuritAgentUpgrader.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools."
+ZeroTier,"ZeroTier*",,,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,"*.zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,"zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,,,"zero-powershell.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,,,"zerotier*.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,,,"zerotier*.msi",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,,,,"zero-powesrhell*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ZeroTier,,,,,"ZeroTier*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist","Zoho Assist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist","ZohoAssist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zoho.com.au",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zoho.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zoho.eu",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zoho.in",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zohoassist.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"*.zohoassist.jp",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"assist.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"downloads.zohocdn.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"downloads.zohodl.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,"gateway.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,"*\ZA_Access.exe",,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"ZMAgent.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"ZohoMeeting.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"ZohoURSService.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"Zohours.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"toolsiq.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"za_connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"zaservice.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,"zohotray.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"Zoho Assist",,,,,"Zoho*",RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+"baramundi Management Suite","baramundi Management Suite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite","baramundiManagementSuite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,"*.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,"docs.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,"isodownload.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,"www.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,,"C:\Program Files\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+"baramundi Management Suite",,,"C:\Program Files\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management."
+eHorus,"eHorus*",,,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,"ehorus.com",,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,"C:\Program Files\ehorus_agent\*",,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,,"ehorus standalone.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,,"ehorus_agent.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,,"ehorus_cmd.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,,"ehorus_launcher.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+eHorus,,,,"ehorus_uit.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,"ezHelp*",,,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,"*.ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,"ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,,,"ezHelpManager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,,,"ezhelpclient.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,,,"ezhelpclientmanager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+ezHelp,,,,,"Mastersoft Corp*",RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+pcAnywhere,"pcAnywhere*",,,,,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+pcAnywhere,,,,"awhost32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+pcAnywhere,,,,"awrem32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+pcAnywhere,,,,"pcaquickconnect.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+pcAnywhere,,,,"winaw32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+rdp2tcp,"rdp2tcp*",,,,,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+rdp2tcp,,,,"rdp2tcp.exe",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+rdp2tcp,,,,"rdp2tcp.py",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available."
+tmate,"tmate*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,"*.tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,"tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,"/usr/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,"/usr/local/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,,tmate,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,,"tmate-ready",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,,"tmate.bashrc",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
+tmate,,,,"tmate.sock",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access."
diff --git a/lookups/csv/remote_access_software.yml b/lookups/csv/remote_access_software.yml
index db897ef6ee..06e6da922f 100644
--- a/lookups/csv/remote_access_software.yml
+++ b/lookups/csv/remote_access_software.yml
@@ -1,15 +1,17 @@
name: remote_access_software
id: f3b92ff9-667c-481f-b29d-458e10d48508
-version: 5
+version: 6
creation_date: '2022-08-22'
-modification_date: '2026-05-13'
+modification_date: '2026-10-19'
author: Splunk Threat Research Team
lookup_type: csv
description: A list of Remote Access Software
match_type:
- - WILDCARD(remote_utility)
- - WILDCARD(remote_domain)
- - WILDCARD(remote_utility_fileinfo)
+ - WILDCARD(match_pattern)
+ - WILDCARD(domain)
+ - WILDCARD(file_path)
+ - WILDCARD(file_name)
+ - WILDCARD(file_info)
min_matches: 1
max_matches: 1
case_sensitive_match: false
diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml
new file mode 100644
index 0000000000..872cc2f0b4
--- /dev/null
+++ b/stories/abuse_of_genai_systems_and_applications.yml
@@ -0,0 +1,23 @@
+name: Abuse of GenAI Systems and Applications
+id: f79c6573-5550-4adc-b673-bb0d8c9e1df1
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+description: |-
+ Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications.
+ Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions.
+narrative: |-
+ AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails.
+ Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available.
+references:
+ - https://atlas.mitre.org/
+ - https://owasp.org/www-project-top-10-for-large-language-model-applications/
+category:
+ - Adversary Tactics
+product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+usecase: Advanced Threat Detection
diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml
index f2ffbf3f1b..c55ebb63d5 100644
--- a/stories/braodo_stealer.yml
+++ b/stories/braodo_stealer.yml
@@ -1,15 +1,28 @@
name: Braodo Stealer
id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24
-version: 2
+version: 3
creation_date: '2024-10-15'
-modification_date: '2026-05-13'
+modification_date: '2026-10-07'
author: Teoderick Contreras, Splunk
status: production
-description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
-narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware.
+description: |-
+ Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems.
+ This malware typically targets login credentials, browser history, cookies, and stored passwords.
+ Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods.
+ Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
+narrative: |-
+ Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems.
+ Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device.
+ Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications.
+ In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API.
+ Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim.
+ For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure.
+ With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts.
+ What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise.
references:
- https://bazaar.abuse.ch/browse/tag/Braodo/
- https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
+ - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
category:
- Data Destruction
- Malware